Create UI Automation Core DLL Loading Detection

[0xPrashanthSec]

Detects when a process loads UIAutomationCore.dll, which may indicate abuse of Microsoft's UI Automation framework. This technique has been observed in Coyote malware for credential theft from banking applications and cryptocurrency exchanges. The rule monitors for processes that load the UI Automation Core library, which enables automated interaction with UI elements.

Summary of the Pull Request

Changelog

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[0xPrashanthSec]

Hi All, I tried to change file name in all formats but still its failing. Can someone help me with that?

[swachchhanda000]

Hi All, I tried to change file name in all formats but still its failing. Can someone help me with that?

It's because you are using the proc_creation prefix for image_load rule.

[0xPrashanthSec]

Hi All, I tried to change file name in all formats but still its failing. Can someone help me with that?

It's because you are using the proc_creation prefix for image_load rule.

Ah, got it let me do changes.

[swachchhanda000]

This rule is already covered by Potential System DLL Sideloading From Non System Locations

[phantinuss]

@prashanthpulisetti Did you observe/produce matches with these? Then we should integrate it to the existing rule

            - '\narrator.exe'
            - '\osk.exe'
            - '\magnify.exe'
            - '\utilman.exe'
            - '\sethc.exe'
            - '\AtBroker.exe'
            - '\displayswitch.exe'

[0xPrashanthSec]

@prashanthpulisetti Did you observe/produce matches with these? Then we should integrate it to the existing rule

            - '\narrator.exe'
            - '\osk.exe'
            - '\magnify.exe'
            - '\utilman.exe'
            - '\sethc.exe'
            - '\AtBroker.exe'
            - '\displayswitch.exe'

Hi @phantinuss , I haven’t tested it yet, but I believe these are legitimate Windows accessibility tools (like Narrator, Magnifier, and On-Screen Keyboard) that typically load UIAutomationCore.dll during normal operation. I added them to the filter to reduce false positives ....

[swachchhanda000]

Closing as a duplicate for now but if an interesting finding came up, please reopen.