#!/usr/bin/env python3
"""DLL sideloading detection agent using Sysmon Event ID 7 (Image Loaded) analysis.

Detects unsigned DLLs loaded by signed executables from non-standard paths,
a common APT persistence and defense evasion technique (T1574.002).
"""

import argparse
import json
import re
from datetime import datetime
from pathlib import Path

try:
    import Evtx.Evtx as evtx
except ImportError:
    evtx = None

KNOWN_SIDELOAD_TARGETS = {
    "vmwaretray.exe": ["vmtools.dll"],
    "colorcpl.exe": ["colorui.dll"],
    "searchprotocolhost.exe": ["msfte.dll"],
    "consent.exe": ["comctl32.dll"],
    "dxcap.exe": ["d3d9.dll"],
    "eventvwr.exe": ["mmc.dll"],
    "msdeploy.exe": ["microsoft.web.deployment.dll"],
    "bginfo.exe": ["version.dll"],
    "winword.exe": ["wwlib.dll"],
    "teams.exe": ["version.dll"],
}

STANDARD_DLL_DIRS = {
    r"c:\windows\system32", r"c:\windows\syswow64",
    r"c:\windows\winsxs", r"c:\program files",
    r"c:\program files (x86)",
}


def parse_sysmon_dll_loads(filepath):
    if evtx is None:
        return {"error": "python-evtx not installed: pip install python-evtx"}
    findings = []
    with evtx.Evtx(filepath) as log:
        for record in log.records():
            xml = record.xml()
            if "<EventID>7</EventID>" not in xml:
                continue
            image = re.search(r'<Data Name="Image">([^<]+)', xml)
            loaded = re.search(r'<Data Name="ImageLoaded">([^<]+)', xml)
            signed = re.search(r'<Data Name="Signed">([^<]+)', xml)
            sig_status = re.search(r'<Data Name="SignatureStatus">([^<]+)', xml)
            sha256 = re.search(r'<Data Name="Hashes">([^<]+)', xml)
            time_created = re.search(r'SystemTime="([^"]+)"', xml)

            if not image or not loaded:
                continue

            image_path = image.group(1).lower()
            dll_path = loaded.group(1).lower()
            is_signed = signed.group(1) if signed else "unknown"
            image_name = image_path.rsplit("\\", 1)[-1]
            dll_name = dll_path.rsplit("\\", 1)[-1]
            dll_dir = dll_path.rsplit("\\", 1)[0] if "\\" in dll_path else ""

            is_standard_dir = any(dll_dir.startswith(d) for d in STANDARD_DLL_DIRS)
            is_known_target = (image_name in KNOWN_SIDELOAD_TARGETS and
                               dll_name in KNOWN_SIDELOAD_TARGETS[image_name])

            if is_signed == "false" and not is_standard_dir:
                severity = "CRITICAL" if is_known_target else "HIGH"
                findings.append({
                    "timestamp": time_created.group(1) if time_created else "",
                    "host_process": image_path,
                    "loaded_dll": dll_path,
                    "signed": is_signed,
                    "signature_status": sig_status.group(1) if sig_status else "",
                    "hash": sha256.group(1) if sha256 else "",
                    "known_sideload_target": is_known_target,
                    "non_standard_path": True,
                    "severity": severity,
                    "mitre": "T1574.002",
                })
    return findings


def scan_directory_for_sideloading(directory):
    findings = []
    dir_path = Path(directory)
    if not dir_path.is_dir():
        return [{"error": f"Directory not found: {directory}"}]
    exe_files = list(dir_path.glob("*.exe"))
    dll_files = list(dir_path.glob("*.dll"))
    for exe in exe_files:
        exe_name = exe.name.lower()
        if exe_name in KNOWN_SIDELOAD_TARGETS:
            for dll in dll_files:
                if dll.name.lower() in KNOWN_SIDELOAD_TARGETS[exe_name]:
                    findings.append({
                        "exe_path": str(exe),
                        "dll_path": str(dll),
                        "dll_size_bytes": dll.stat().st_size,
                        "known_sideload_pair": True,
                        "severity": "CRITICAL",
                        "mitre": "T1574.002",
                        "description": f"Known sideloading pair: {exe.name} + {dll.name}",
                    })
    return findings


def generate_sigma_rule():
    return {
        "title": "DLL Sideloading - Unsigned DLL in Non-Standard Path",
        "status": "experimental",
        "logsource": {"product": "windows", "category": "image_load"},
        "detection": {
            "selection": {"EventID": 7, "Signed": "false"},
            "filter_standard": {"ImageLoaded|startswith": [
                "C:\\Windows\\System32\\", "C:\\Windows\\SysWOW64\\",
                "C:\\Program Files\\", "C:\\Program Files (x86)\\"
            ]},
            "condition": "selection and not filter_standard"
        },
        "level": "high",
        "tags": ["attack.defense_evasion", "attack.t1574.002"],
    }


def main():
    parser = argparse.ArgumentParser(description="DLL Sideloading Detector")
    parser.add_argument("--sysmon-log", help="Sysmon EVTX file with Event ID 7")
    parser.add_argument("--scan-dir", help="Directory to scan for sideloading pairs")
    parser.add_argument("--generate-sigma", action="store_true")
    args = parser.parse_args()

    results = {"timestamp": datetime.utcnow().isoformat() + "Z", "findings": []}

    if args.sysmon_log:
        evtx_findings = parse_sysmon_dll_loads(args.sysmon_log)
        if isinstance(evtx_findings, dict) and "error" in evtx_findings:
            results["error"] = evtx_findings["error"]
        else:
            results["findings"].extend(evtx_findings)

    if args.scan_dir:
        dir_findings = scan_directory_for_sideloading(args.scan_dir)
        results["findings"].extend(dir_findings)

    if args.generate_sigma:
        results["sigma_rule"] = generate_sigma_rule()

    results["total_findings"] = len(results["findings"])
    print(json.dumps(results, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
DLL Sideloading Detection Script
Analyzes DLL load events for sideloading indicators including unsigned DLLs,
path anomalies, and known vulnerable application abuse.
"""

import json
import csv
import argparse
import datetime
import re
from collections import defaultdict
from pathlib import Path

KNOWN_SIDELOAD_TARGETS = {
    "version.dll": ["OneDriveUpdater.exe", "Grammarly.exe"],
    "cryptsp.dll": ["Teams.exe"],
    "dismcore.dll": ["DismHost.exe"],
    "mpclient.dll": ["MpCmdRun.exe"],
    "dbgcore.dll": ["WerFault.exe"],
    "wbemcomn.dll": ["mmc.exe"],
    "comsvcs.dll": ["rundll32.exe"],
    "uxtheme.dll": ["Multiple"],
    "dwmapi.dll": ["Multiple"],
    "winmm.dll": ["Multiple"],
    "dxgi.dll": ["Multiple"],
}

LEGITIMATE_DLL_PATHS = [
    r"C:\\Windows\\System32\\",
    r"C:\\Windows\\SysWOW64\\",
    r"C:\\Windows\\WinSxS\\",
    r"C:\\Program Files\\",
    r"C:\\Program Files \(x86\)\\",
]

SUSPICIOUS_DLL_PATHS = [
    r"\\Temp\\", r"\\tmp\\", r"\\AppData\\Local\\Temp\\",
    r"\\Users\\Public\\", r"\\Downloads\\", r"\\Desktop\\",
    r"\\ProgramData\\(?!Microsoft)",
]


def parse_logs(input_path: str) -> list[dict]:
    path = Path(input_path)
    if path.suffix == ".json":
        with open(path, "r", encoding="utf-8") as f:
            data = json.load(f)
            return data if isinstance(data, list) else data.get("events", [])
    elif path.suffix == ".csv":
        with open(path, "r", encoding="utf-8-sig") as f:
            return [dict(row) for row in csv.DictReader(f)]
    return []


def normalize_event(event: dict) -> dict:
    field_map = {
        "event_id": ["EventCode", "EventID"],
        "image": ["Image", "InitiatingProcessFileName"],
        "dll_loaded": ["ImageLoaded", "FileName", "FolderPath"],
        "signed": ["Signed", "IsSigned"],
        "signature": ["Signature", "SignatureType"],
        "hashes": ["Hashes", "SHA256"],
        "hostname": ["Computer", "DeviceName"],
        "user": ["User", "AccountName"],
        "timestamp": ["UtcTime", "Timestamp"],
    }
    normalized = {}
    for target, sources in field_map.items():
        for src in sources:
            if src in event and event[src]:
                normalized[target] = str(event[src])
                break
        if target not in normalized:
            normalized[target] = ""
    return normalized


def detect_sideloading(event: dict) -> dict | None:
    if event.get("event_id") != "7":
        return None

    dll_path = event.get("dll_loaded", "").lower()
    image_path = event.get("image", "").lower()
    signed = event.get("signed", "").lower()
    dll_name = dll_path.split("\\")[-1] if dll_path else ""
    app_name = image_path.split("\\")[-1] if image_path else ""

    risk = 0
    indicators = []

    # Check if DLL is a known sideloading target
    if dll_name in KNOWN_SIDELOAD_TARGETS:
        # Check if loaded from non-standard path
        is_legit_path = any(re.search(p, dll_path, re.IGNORECASE) for p in LEGITIMATE_DLL_PATHS)
        if not is_legit_path:
            risk += 40
            indicators.append(f"Known sideload target DLL: {dll_name}")

    # Check for unsigned DLL
    if signed in ("false", "0", ""):
        risk += 20
        indicators.append("Unsigned DLL loaded")

    # Check for suspicious DLL path
    for pattern in SUSPICIOUS_DLL_PATHS:
        if re.search(pattern, dll_path, re.IGNORECASE):
            risk += 25
            indicators.append(f"DLL in suspicious path: {pattern}")
            break

    # Check for app running from unusual location
    app_in_standard = any(re.search(p, image_path, re.IGNORECASE) for p in LEGITIMATE_DLL_PATHS)
    if not app_in_standard and app_name:
        for pattern in SUSPICIOUS_DLL_PATHS:
            if re.search(pattern, image_path, re.IGNORECASE):
                risk += 20
                indicators.append(f"Host application in suspicious path")
                break

    if not indicators:
        return None

    risk_level = "CRITICAL" if risk >= 70 else "HIGH" if risk >= 50 else "MEDIUM" if risk >= 30 else "LOW"

    return {
        "detection_type": "DLL_SIDELOADING",
        "technique": "T1574.002",
        "host_application": image_path,
        "sideloaded_dll": dll_path,
        "dll_name": dll_name,
        "signed": signed,
        "hostname": event.get("hostname", "unknown"),
        "user": event.get("user", "unknown"),
        "timestamp": event.get("timestamp", "unknown"),
        "risk_score": risk,
        "risk_level": risk_level,
        "indicators": indicators,
    }


def run_hunt(input_path: str, output_dir: str) -> None:
    print(f"[*] DLL Sideloading Hunt - {datetime.datetime.now().isoformat()}")
    events = [normalize_event(e) for e in parse_logs(input_path)]
    print(f"[*] Loaded {len(events)} events")

    findings = [f for f in (detect_sideloading(e) for e in events) if f]

    output_path = Path(output_dir)
    output_path.mkdir(parents=True, exist_ok=True)

    with open(output_path / "sideload_findings.json", "w", encoding="utf-8") as f:
        json.dump({
            "hunt_id": f"TH-SIDELOAD-{datetime.date.today().isoformat()}",
            "total_events": len(events),
            "findings": sorted(findings, key=lambda x: x["risk_score"], reverse=True),
        }, f, indent=2)

    print(f"[+] {len(findings)} findings written to {output_dir}")


def main():
    parser = argparse.ArgumentParser(description="DLL Sideloading Detection")
    subparsers = parser.add_subparsers(dest="command")
    hunt_p = subparsers.add_parser("hunt")
    hunt_p.add_argument("--input", "-i", required=True)
    hunt_p.add_argument("--output", "-o", default="./sideload_output")
    subparsers.add_parser("queries")
    args = parser.parse_args()
    if args.command == "hunt":
        run_hunt(args.input, args.output)
    elif args.command == "queries":
        print("=== Sysmon DLL Load Queries ===")
        print('index=sysmon EventCode=7 Signed=false\n| stats count by Image ImageLoaded Computer\n| sort -count')
    else:
        parser.print_help()


if __name__ == "__main__":
    main()