huntrule

Suspicious Extexport DLL Side-Loading Execution

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-08-04
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects execution of the Internet Explorer Extexport.exe utility which loads mozcrt19, mozsqlite3 or sqlite3 DLLs from its working directory. In the WithSecure Code Execution and Persistence Lab 1 the Astaroth chain drops malicious DLLs of these names next to Extexport.exe to achieve DLL side-loading. Attackers proxy code execution through this signed LOLBin to run their payload under a trusted process.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange
Malicious ViPNet Backdoor Loader via lumpdiag.exe Path Substitution
Suspicious DLL Sideload of profiler16.dll (via image_load)
Malicious PUBLOAD Fake Windows Update C2 Request via Proxy (via proxy)
Suspicious MicrosoftEdgeUpdate Launched with Dat Config File
Suspicious GoogleUpdate Binary Executing From Non-Standard Path (via process_creation)
Suspicious extrac32 CAB Extraction Abuse
Malicious cdb.exe Masquerading as fontdrvhost in ProgramData (via process_creation)
Malicious certutil Decodehex Payload Reconstruction by DarkGate
Suspicious MpClient DLL Sideload from Non-Defender Path
Suspicious Extexport DLL Side-Loading Execution
Pivot detection · T1574.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.