Windows DLL Sideloading: appverifUI.DLL Loaded from Non-Standard Paths

Alerts when appverifUI.dll is loaded on Windows from unexpected paths, a common DLL sideloading technique.

FreeUnreviewedSigmahighv1

windows-dll-sideloading-appverifui-dll-loaded-from-non-standard-paths-ee6cea48

title: "Windows DLL Sideloading: appverifUI.DLL Loaded from Non-Standard Paths"
id: 1f4bd906-c7ca-4a2a-a5d6-4e7aa1285663
status: test
description: This rule flags cases where Windows loads appverifUI.dll via ImageLoad events when the DLL path does not match expected locations. Attackers can use DLL sideloading to execute malicious code in the context of a legitimate process, relying on the operating system’s DLL search and load behavior. The detection relies on telemetry that records loaded image paths for DLLs and compares them against a allowlist of likely legitimate appverif-related locations.
references:
  - https://web.archive.org/web/20220519091349/https://fatrodzianko.com/2020/02/15/dll-side-loading-appverif-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_appverifui.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-20
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \appverifUI.dll
  filter_main_legit_path:
    Image:
      - C:\Windows\SysWOW64\appverif.exe
      - C:\Windows\System32\appverif.exe
    ImageLoaded|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: ee6cea48-c5b6-4304-a332-10fc6446f484
    type: derived

What it detects

This rule flags cases where Windows loads appverifUI.dll via ImageLoad events when the DLL path does not match expected locations. Attackers can use DLL sideloading to execute malicious code in the context of a legitimate process, relying on the operating system’s DLL search and load behavior. The detection relies on telemetry that records loaded image paths for DLLs and compares them against a allowlist of likely legitimate appverif-related locations.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.