Detect Hijacked DLLs

hijack dlls.vql

LET Glob = '''C:\windows\**\*.dll'''

-- Apply the glob to search for matching DLLs.
LET DLLs = SELECT FullPath, Name, parse_pe(file=FullPath).Forwards AS Forwards,
     lowcase(string=parse_string_with_regex(regex="^(?P<BareName>[^.]+)", string=Name).BareName) AS DLLBareName
FROM glob(globs=Glob)
WHERE NOT FullPath =~ "(WinSXS|Servicing)"

-- For each DLL, extract the forward strings.
SELECT * FROM foreach(row=DLLs, workers=20,
query={
  -- For each forwarded export, split the string into 
  -- a DLL path and export name
  SELECT FullPath AS DllPath, ForwardedImport,
         Parse.DllPath AS DllImportPath,
         Parse.Export AS DLLExportFunc,
         DLLBareName,
         basename(path=lowcase(string=Parse.DllPath)) AS ExportDLLName
  FROM foreach(row=Forwards,
  query={
      SELECT parse_string_with_regex(
          regex="(?P<DllPath>.+)\\.(?P<Export>[^.]+$)", string=_value) AS Parse,
          _value AS ForwardedImport
      FROM scope()
  })
  -- Only select forwarded functions that forward to the same dll name.
  WHERE ExportDLLName = DLLBareName
})