Windows Amsi.dll Loaded by Living-off-the-Land Processes (ExtExport.exe/Odbcconf.exe/Rundll32.exe)

Alert on amsi.dll DLL loads initiated by ExtExport.exe, Odbcconf.exe, or Rundll32.exe on Windows.

FreeUnreviewedSigmamediumv1

windows-amsi-dll-loaded-by-living-off-the-land-processes-extexport-exe-odbcconf--6ec86d9e

title: Windows Amsi.dll Loaded by Living-off-the-Land Processes (ExtExport.exe/Odbcconf.exe/Rundll32.exe)
id: 446af65d-8952-4c67-972b-92481ec46bd3
status: test
description: This rule flags Windows events where a DLL load for amsi.dll is observed from specific living-off-the-land executable processes. Attackers may use trusted Windows binaries to trigger security-relevant behavior while blending into normal activity, so unexpected amsi.dll loads from these processes can be a useful signal. The detection relies on image load telemetry that records the loaded DLL path and the loading process image.
references:
  - Internal Research
  - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_amsi_suspicious_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-01
modified: 2025-10-07
tags:
  - attack.defense-impairment
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \amsi.dll
    Image|endswith:
      - \ExtExport.exe
      - \odbcconf.exe
      - \rundll32.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6ec86d9e-912e-4726-91a2-209359b999b9
    type: derived

What it detects

This rule flags Windows events where a DLL load for amsi.dll is observed from specific living-off-the-land executable processes. Attackers may use trusted Windows binaries to trigger security-relevant behavior while blending into normal activity, so unexpected amsi.dll loads from these processes can be a useful signal. The detection relies on image load telemetry that records the loaded DLL path and the loading process image.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.