Windows DLL side-loading via appverifUI.dll image loads

Alerts when appverifUI.dll is loaded on Windows from unexpected paths, a common DLL sideloading technique.

FreeReviewedSigma · High · v2

Product: windows
Category: image_load
Author: X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-06-20
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1574.001DLL
Defense Evasion
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process image-load events where a DLL named appverifUI.dll is loaded from paths other than the expected, legitimate Windows locations for appverif.exe components. Attackers may use DLL side-loading to execute malicious code under the context of a trusted binary, aiming for stealth and persistence. It relies on Windows image-load telemetry (category: image_load) capturing the full ImageLoaded path for the DLL.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

Malicious DLL Sideloading via consent.exe Loading msimg32.dll (via image_load)

Malicious Bumblebee DLL Sideload of msimg32 by consent from Non-System Path (via image_load)

Suspicious BugSplat Binary Sideloading bugsplatrc.dll via DLL Search Order Hijack

Suspicious SentinelOne Binary Sideloading sentinelagentcore.dll

Suspicious 7-Zip Executable Sideloading 7z.dll Loader

Suspicious Loading of Masqueraded EndpointDlp.dll Backdoor

Suspicious Trend Micro Binary Sideloading tmdglog.dll

Suspicious DLL Sideloading via ProtonVPN Executable (via image_load)

Suspicious DLL Sideloading via OneDriveStandaloneUpdater (via image_load)

Windows DLL side-loading via appverifUI.dll image loads

Pivot detection · T1574.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dll-sideloading-appverifui-dll-loaded-from-non-standard-paths-ee6cea48

title: Windows DLL side-loading via appverifUI.dll image loads
id: 1f4bd906-c7ca-4a2a-a5d6-4e7aa1285663
status: test
description: "This rule flags process image-load events where a DLL named appverifUI.dll is loaded from paths other than the expected, legitimate Windows locations for appverif.exe components. Attackers may use DLL side-loading to execute malicious code under the context of a trusted binary, aiming for stealth and persistence. It relies on Windows image-load telemetry (category: image_load) capturing the full ImageLoaded path for the DLL."
references:
  - https://web.archive.org/web/20220519091349/https://fatrodzianko.com/2020/02/15/dll-side-loading-appverif-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_appverifui.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-20
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \appverifUI.dll
  filter_main_legit_path:
    Image:
      - C:\Windows\SysWOW64\appverif.exe
      - C:\Windows\System32\appverif.exe
    ImageLoaded|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: ee6cea48-c5b6-4304-a332-10fc6446f484
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL