Suspicious WINWORD.exe DLL loading via /l flag and .dll path on Windows

Flags WINWORD.exe runs that include /l and a .dll indicator, suggesting potential DLL sideloading on Windows.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Victor Sergeev, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-09
Updated
2026-07-30

ATT&CK techniques

Defense Evasion
  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Cred Access

  8. Discovery

  9. Lateral Movement

  10. Collection

  11. C2

  12. Exfiltration

  13. Impact

What it detects

This rule flags process creation events where WINWORD.exe is invoked with a command line containing the /l flag and a .dll reference, indicating potential DLL sideloading behavior. Attackers may use Office application loading mechanisms to execute attacker-controlled code stealthily through a malicious DLL. The detection relies on Windows process creation telemetry, specifically the executable path/name and the full command line content.

Related detections9 linkedT1202 — drag to rearrange
Windows SFTP.exe Indirect Command Execution via ProxyCommand
WSL Process Execution of Kali Linux on Windows
Windows vshadow.exe Proxy Execution via -exec Script/Command
Windows ConHost Spawning Suspicious Script and Command-Line Child Processes
Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName
Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line
Windows Process Creation: Execution of Renamed curl.exe via PE Metadata
Suspicious Child Process Creation from BgInfo.EXE on Windows
Windows Bash.exe Launched Without Script Execution Arguments
Suspicious WINWORD.exe DLL loading via /l flag and .dll path on Windows
Pivot detection · T1202 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.