Detection: Windows Known Abused DLL Loaded Suspiciously

 1`sysmon` ImageLoaded EventCode=7 NOT ImageLoaded IN ("*\\Program Files*","*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*") 
 2| stats latest(ProcessGuid) as process_guid, count, min(_time) as firstTime, max(_time) as lastTime by User, Computer, Image, ImageLoaded 
 3| rename User as user, Computer as dest, Image as process, ImageLoaded as loaded_file 
 4| eval process_name = case(isnotnull(process),replace(process,"(.*\\\)(?=.*(\.\w*)$
 5|(\w+)$)","")), loaded_file_path = case(isnotnull(loaded_file), replace(loaded_file, "(:[\w\. ]+)", "")), loaded_file = case(isnotnull(loaded_file),replace(loaded_file,"(.*\\\)(?=.*(\.\w*)$
 6|(\w+)$)","")), user = case(NOT user IN ("-"), replace(user, "(.*)\\\(.+)$","\2")) 
 7| lookup hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as desc 
 8| lookup hijacklibs_loaded library AS loaded_file excludes as loaded_file_path OUTPUT islibrary as excluded 
 9| search islibrary = TRUE AND excluded = false 
10| stats values(*) as * by dest, process_name, process, process_guid, loaded_file, loaded_file_path 
11| `security_content_ctime(firstTime)` 
12| `security_content_ctime(lastTime)` 
13| `windows_known_abused_dll_loaded_suspiciously_filter`