Windows: Detect Loading amsi.dll by LOLBIN Processes
Alert on amsi.dll DLL loads initiated by ExtExport.exe, Odbcconf.exe, or Rundll32.exe on Windows.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- image_load
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-01
- Updated
- 2026-07-31
What it detects
This rule flags events where a process loads amsi.dll via common living-off-the-land executables (ExtExport.exe, odbcconf.exe, or rundll32.exe). Loading amsi.dll outside expected application flows can indicate defense-impairment behavior where attackers interact with Windows security interfaces. It relies on Windows image load telemetry indicating which module was loaded and which process performed the load.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-amsi-dll-loaded-by-living-off-the-land-processes-extexport-exe-odbcconf--6ec86d9e
title: "Windows: Detect Loading amsi.dll by LOLBIN Processes"
id: 446af65d-8952-4c67-972b-92481ec46bd3
status: test
description: This rule flags events where a process loads amsi.dll via common living-off-the-land executables (ExtExport.exe, odbcconf.exe, or rundll32.exe). Loading amsi.dll outside expected application flows can indicate defense-impairment behavior where attackers interact with Windows security interfaces. It relies on Windows image load telemetry indicating which module was loaded and which process performed the load.
references:
- Internal Research
- https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_amsi_suspicious_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-01
modified: 2025-10-07
tags:
- attack.defense-impairment
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: \amsi.dll
Image|endswith:
- \ExtExport.exe
- \odbcconf.exe
- \rundll32.exe
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 6ec86d9e-912e-4726-91a2-209359b999b9
type: derived