Real-Time Detection System Against Malicious Tools by Monitoring DLL on Client Computers

The targeted attacks cause severe damage worldwide. Detecting targeted attacks are challenging because the attack methods are very sophisticated. Network-based solutions such as Firewall, Proxy Server, and Intrusion Detection System (IDS) have been widely used. In addition to this, recently, detection methods for malicious programs by monitoring behavior on the endpoints called Endpoint Detection and Response (EDR) have been proposed. Also, some researchers introduce detection methods using DLLs by analyzing suspicious files on the sandbox, such as Cuckoo. Using Cuckoo is one of the solutions for analyzing files that are already identified as malicious. In this research, we propose a real-time detection method of malicious tools using DLL information collected by System Monitor (Sysmon): a free logging tool provided by Microsoft. The purpose of our method is detecting new malicious processes in the production environment. We focus on DLLs commonly loaded by malicious tools regardless of the environments, then propose “the common DLL lists” for detection. Moreover, we introduce a practical detection method that utilizes Elastic Stack as Security Information and Event Management (SIEM). By using Elastic Stack, DLL information loaded on computers can be uniformly monitored and enables real-time detection by comparing logs with the common DLL lists. We evaluate the effectivity of the proposed method using four free malicious tools introduced by US-CERT: China Chopper, Mimikatz, PowerShell Empire, and HUC Packet Transmitter. As a result, our method detected China Chopper, Mimikatz, PowerShell Empire with 100% accuracy. A few false positive occurred for HUC Packet Transmitter, and false positive rate was 0.55%. We confirmed that the common DLL lists are useful for detecting malicious tools in real-time using Elastic Stack.