Windows Image Load of Specific System DLLs Not Normally Present in System Directories
Alerts on image load events for specific system-path DLLs with unexpected “phantom” DLL names on Windows.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- image_load
- Author
- Nasreddine Bencherchali (Nextron Systems), SBousseaden (SigmaHQ), DRL 1.1
- Published
- 2022-12-09
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process image loads for a set of specific system DLL paths that are typically not present on the host (or at least not in system directories) but may still be requested by legitimate processes. Such unexpected DLL loads can indicate phantom DLL hijacking, where attackers aim to have a process load a malicious library using a system-matching name and location. It relies on Windows image load telemetry that includes the loaded module path, along with signature-related fields to filter out Microsoft-signed, valid signatures.
Reporting behind it
- remoteawesomethoughts.blogspot.comhttp://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
- clement.notin.orghttps://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/
- decoded.avast.iohttps://decoded.avast.io/martinchlumecky/png-steganography/
- github.comhttps://github.com/Wh04m1001/SysmonEoP
- itm4n.github.iohttps://itm4n.github.io/cdpsvc-dll-hijacking/
- posts.specterops.iohttps://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
- securelist.comhttps://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/
- crowdstrike.comhttps://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/
- hexacorn.comhttps://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
- hexacorn.comhttps://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/
- hexacorn.comhttps://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/
- x.comhttps://x.com/0gtweet/status/1564131230941122561
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_non_existent_dlls.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-dll-loading-from-system-directories-using-specific-phantom-dll-names-6b98b92b
title: Windows Image Load of Specific System DLLs Not Normally Present in System Directories
id: b8c182e9-7da8-4ded-8232-8beae56ddc46
related:
- id: df6ecb8b-7822-4f4b-b412-08f524b4576c
type: similar
- id: 602a1f13-c640-4d73-b053-be9a2fa58b77
type: obsolete
- id: 6b98b92b-4f00-4f62-b4fe-4d1920215771
type: derived
status: test
description: This rule flags process image loads for a set of specific system DLL paths that are typically not present on the host (or at least not in system directories) but may still be requested by legitimate processes. Such unexpected DLL loads can indicate phantom DLL hijacking, where attackers aim to have a process load a malicious library using a system-matching name and location. It relies on Windows image load telemetry that includes the loaded module path, along with signature-related fields to filter out Microsoft-signed, valid signatures.
references:
- http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
- https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/
- https://decoded.avast.io/martinchlumecky/png-steganography/
- https://github.com/Wh04m1001/SysmonEoP
- https://itm4n.github.io/cdpsvc-dll-hijacking/
- https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
- https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/
- https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/
- https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
- https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/
- https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/
- https://x.com/0gtweet/status/1564131230941122561
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_non_existent_dlls.yml
author: Nasreddine Bencherchali (Nextron Systems), SBousseaden, Huntrule Team
date: 2022-12-09
modified: 2026-01-24
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith:
- :\Windows\System32\axeonoffhelper.dll
- :\Windows\System32\cdpsgshims.dll
- :\Windows\System32\oci.dll
- :\Windows\System32\offdmpsvc.dll
- :\Windows\System32\shellchromeapi.dll
- :\Windows\System32\TSMSISrv.dll
- :\Windows\System32\TSVIPSrv.dll
- :\Windows\System32\wbem\wbemcomn.dll
- :\Windows\System32\WLBSCTRL.dll
- :\Windows\System32\wow64log.dll
- :\Windows\System32\WptsExtensions.dll
filter_main_ms_signed:
Signed: "true"
SignatureStatus: Valid
Signature: Microsoft Windows
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1