Windows DLL Loading From System Directories Using Specific “Phantom” DLL Names

title: Windows DLL Loading From System Directories Using Specific “Phantom” DLL Names
id: b8c182e9-7da8-4ded-8232-8beae56ddc46
related:
  - id: df6ecb8b-7822-4f4b-b412-08f524b4576c
    type: similar
  - id: 602a1f13-c640-4d73-b053-be9a2fa58b77
    type: obsolete
  - id: 6b98b92b-4f00-4f62-b4fe-4d1920215771
    type: derived
status: test
description: This rule flags processes loading a defined set of DLLs from Windows system paths even though the DLL names are typically not expected to exist on the host in those locations. This matters because attackers may use “phantom” DLL hijacking patterns—leveraging normal DLL search and load behavior to execute malicious binaries masquerading as non-standard system DLLs. The detection relies on image load telemetry that records the full DLL path and supports filtering to exclude successfully Microsoft-signed, valid-signature DLL loads.
references:
  - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
  - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/
  - https://decoded.avast.io/martinchlumecky/png-steganography/
  - https://github.com/Wh04m1001/SysmonEoP
  - https://itm4n.github.io/cdpsvc-dll-hijacking/
  - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
  - https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/
  - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/
  - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
  - https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/
  - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/
  - https://x.com/0gtweet/status/1564131230941122561
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_non_existent_dlls.yml
author: Nasreddine Bencherchali (Nextron Systems), SBousseaden, Huntrule Team
date: 2022-12-09
modified: 2026-01-24
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - :\Windows\System32\axeonoffhelper.dll
      - :\Windows\System32\cdpsgshims.dll
      - :\Windows\System32\oci.dll
      - :\Windows\System32\offdmpsvc.dll
      - :\Windows\System32\shellchromeapi.dll
      - :\Windows\System32\TSMSISrv.dll
      - :\Windows\System32\TSVIPSrv.dll
      - :\Windows\System32\wbem\wbemcomn.dll
      - :\Windows\System32\WLBSCTRL.dll
      - :\Windows\System32\wow64log.dll
      - :\Windows\System32\WptsExtensions.dll
  filter_main_ms_signed:
    Signed: "true"
    SignatureStatus: Valid
    Signature: Microsoft Windows
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1