Aruba Network Service Potential DLL Sideloading
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process. This rule specifically looks for the arubanetsvc.exe process loading specific DLLs (wtsapi32.dll, msvcr100.dll, msvcp100.dll, dbghelp.dll, dbgcore.dll, wininet.dll, iphlpapi.dll, version.dll, cryptsp.dll, cryptbase.dll, wldp.dll, profapi.dll, sspicli.dll, winsta.dll, dpapi.dll) from a location other than the standard Windows system directories (C:\Windows\System32\, C:\Windows\SysWOW64\, C:\Windows\WinSxS\). This behavior is indicative of DLL Search Order Hijacking, where an attacker places a malicious DLL in a directory that is searched before the legitimate system DLLs, causing the application to load the malicious version.
Sigma
