huntrule

Windows DLL Side-Loading: edputil.dll Loaded from Non-System Paths

Alerts on edputil.dll image loads occurring outside standard Windows system directories, suggesting possible DLL side-loading.

FreeUnreviewedSigmahighv1
title: "Windows DLL Side-Loading: edputil.dll Loaded from Non-System Paths"
id: 9b38ec46-f76a-49d9-a148-be6745e853f4
status: test
description: This rule flags process image load events where edputil.dll is loaded from a path that does not begin with common Windows system directories. DLL side-loading can let an attacker execute malicious code by forcing a binary to load a crafted or replaced DLL at runtime. It relies on Windows image load telemetry that records the loaded module path, filtering out typical system locations to reduce benign hits.
references:
  - https://alternativeto.net/news/2023/5/cybercriminals-use-wordpad-vulnerability-to-spread-qbot-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_edputil.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-09
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \edputil.dll
  filter_main_generic:
    ImageLoaded|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e4903324-1a10-4ed3-981b-f6fe3be3a2c2
    type: derived

What it detects

This rule flags process image load events where edputil.dll is loaded from a path that does not begin with common Windows system directories. DLL side-loading can let an attacker execute malicious code by forcing a binary to load a crafted or replaced DLL at runtime. It relies on Windows image load telemetry that records the loaded module path, filtering out typical system locations to reduce benign hits.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.