Windows DLL Sideloading: ImageLoads rcdll.dll from Non-VS/Windows Kits Paths

title: "Windows DLL Sideloading: ImageLoads rcdll.dll from Non-VS/Windows Kits Paths"
id: 2b3e1dda-dce3-4b7e-9170-ae8d3d430eb1
status: test
description: This rule identifies potential DLL sideloading by flagging Windows image loads where the loaded filename ends with rcdll.dll, excluding cases originating from Visual Studio and Windows Kits directories. Attackers may use DLL search-order behavior to load malicious or substituted DLLs under a trusted name to achieve persistence, privilege escalation, or stealth. The detection relies on Windows image load telemetry that records the loaded DLL path via an image_load event and evaluates the file name and path prefix.
references:
  - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_rcdll.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-03-13
modified: 2023-03-15
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \rcdll.dll
  filter:
    ImageLoaded|startswith:
      - C:\Program Files (x86)\Microsoft Visual Studio\
      - C:\Program Files (x86)\Windows Kits\
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6e78b74f-c762-4800-82ad-f66787f10c8a
    type: derived