huntrule

Windows: Detect Aruba Netsvc DLL Search Order Hijacking via arubanetsvc.exe Loaded DLLs

Flags arubanetsvc.exe loading targeted DLLs outside standard system paths, suggesting possible DLL search order hijacking.

FreeReviewedSigma · High · v2
Product
windows
Category
image_load
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-01-22
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags DLL loads associated with the Aruba Networks Virtual Intranet Access process arubanetsvc.exe, focusing on DLLs commonly targeted for DLL search order hijacking. Attackers may abuse DLL resolution to execute malicious code in the context of a legitimate signed application. The detection relies on image_load telemetry capturing the loaded DLL image paths and matching arubanetsvc.exe alongside specific DLL names, excluding loads from standard Windows system directories.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange
Malicious DLL Sideloading via Cisco Webex ptService Loading wbxtrace From Non-Standard Path (via image_load)
APT32 DLL Sideloading via Analyzer.exe Loading mglobal.dll (via image_load)
Suspicious DLL Sideloaded by a Signed Binary From a User-Writable Path (via image_load)
Suspicious C2Looper DLL Side-Loading via OneDrive wtsapi32 (via file_event)
Suspicious Tablacus Explorer Execution from ProgramData for DLL Search-Order Hijacking
Suspicious calc.exe Quit Execution From Non-System Directory via DLL Side-Loading
Suspicious ctfmon.exe Execution From Non-System Directory via DLL Side-Loading
Malicious DLL Sideloading via consent.exe Loading msimg32.dll (via image_load)
Malicious Bumblebee DLL Sideload of msimg32 by consent from Non-System Path (via image_load)
Windows: Detect Aruba Netsvc DLL Search Order Hijacking via arubanetsvc.exe Loaded DLLs
Pivot detection · T1574.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.