Windows DLL Hijacking: libvlc.dll Sideloading via Non-Default Image Load

Alerts when libvlc.dll is loaded from a non-default path, suggesting potential VLC DLL sideloading on Windows.

FreeUnreviewedSigmamediumv1

windows-dll-hijacking-libvlc-dll-sideloading-via-non-default-image-load-bf9808c4

title: "Windows DLL Hijacking: libvlc.dll Sideloading via Non-Default Image Load"
id: 9db55d5d-4293-43a6-bead-c36cff14b974
status: test
description: This rule flags DLL loads where an image named "libvlc.dll" is loaded, but the load path does not begin with the expected default VLC installation directories. Attackers can abuse DLL search order hijacking/sideloading by placing or redirecting a malicious DLL so a legitimate executable loads it. The detection relies on Windows image-load telemetry indicating the full path of loaded DLLs (ImageLoaded).
references:
  - https://www.trendmicro.com/en_us/research/23/c/earth-preta-updated-stealthy-strategies.html
  - https://hijacklibs.net/entries/3rd_party/vlc/libvlc.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_libvlc.yml
author: X__Junior, Huntrule Team
date: 2023-04-17
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \libvlc.dll
  filter_main_vlc:
    ImageLoaded|startswith:
      - C:\Program Files (x86)\VideoLAN\VLC\
      - C:\Program Files\VideoLAN\VLC\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - False positives are expected if VLC is installed in non-default locations
level: medium
license: DRL-1.1
related:
  - id: bf9808c4-d24f-44a2-8398-b65227d406b6
    type: derived

What it detects

This rule flags DLL loads where an image named "libvlc.dll" is loaded, but the load path does not begin with the expected default VLC installation directories. Attackers can abuse DLL search order hijacking/sideloading by placing or redirecting a malicious DLL so a legitimate executable loads it. The detection relies on Windows image-load telemetry indicating the full path of loaded DLLs (ImageLoaded).

Known false positives

False positives are expected if VLC is installed in non-default locations

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.