title: Xwizard DLL Sideloading
author: Christian Burkard
date: 2021/09/20
description: Detects the execution of Xwizard tool from the non-default directory
  which can be used to sideload a custom xwizards.dll
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image: '*\xwizard.exe'
  SELECTION_3:
    Image: C:\Windows\System32\\*
  condition: (SELECTION_1 and SELECTION_2 and  not (SELECTION_3))
falsepositives:
- Windows installed on non-C drive
id: 193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1
level: high
logsource:
  category: process_creation
  product: windows
references:
- https://lolbas-project.github.io/lolbas/Binaries/Xwizard/
- http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
status: experimental
tags:
- attack.defense_evasion
- attack.t1574.002
ruletype: SIGMA