Windows DLL Sideloading Indicators via ImageLoaded of System DLL Names
Alerts when Windows image loads DLL names typically found in system locations, excluding common benign paths to reduce false positives.
FreeUnreviewedSigmahighv1
windows-dll-sideloading-indicators-via-imageloaded-of-system-dll-names-4fc0deee
title: Windows DLL Sideloading Indicators via ImageLoaded of System DLL Names
id: e35ce6fd-3d01-45c5-b6f4-9b45100ef9c4
status: test
description: This rule flags cases where Windows loads DLLs commonly associated with system components by matching their names in ImageLoaded telemetry. DLL sideloading matters because attackers can place or reference malicious copies of “legitimate” DLLs so a trusted process loads attacker-controlled code. The detection relies on the image load events (ImageLoaded) and narrows results by excluding common legitimate system and software-cache paths via allowlist-style filters.
references:
- https://hijacklibs.net/
- https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/
- https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/
- https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md
- https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
- https://www.sophos.com/en-us/blog/finding-minhook-in-a-sideloading-attack-and-sweden-too
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_from_non_system_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-14
modified: 2026-07-10
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith:
- \aclui.dll
- \activeds.dll
- \adsldpc.dll
- \aepic.dll
- \apphelp.dll
- \applicationframe.dll
- \appvpolicy.dll
- \appxalluserstore.dll
- \appxdeploymentclient.dll
- \archiveint.dll
- \atl.dll
- \audioses.dll
- \auditpolcore.dll
- \authfwcfg.dll
- \authz.dll
- \avrt.dll
- \batmeter.dll
- \bcd.dll
- \bcp47langs.dll
- \bcp47mrm.dll
- \bcrypt.dll
- \bderepair.dll
- \bootmenuux.dll
- \bootux.dll
- \cabinet.dll
- \cabview.dll
- \certcli.dll
- \certenroll.dll
- \cfgmgr32.dll
- \cldapi.dll
- \clipc.dll
- \clusapi.dll
- \cmpbk32.dll
- \cmutil.dll
- \coloradapterclient.dll
- \colorui.dll
- \comdlg32.dll
- \configmanager2.dll
- \connect.dll
- \coredplus.dll
- \coremessaging.dll
- \coreuicomponents.dll
- \credui.dll
- \cryptbase.dll
- \cryptdll.dll
- \cryptsp.dll
- \cryptui.dll
- \cryptxml.dll
- \cscapi.dll
- \cscobj.dll
- \cscui.dll
- \d2d1.dll
- \d3d10_1.dll
- \d3d10_1core.dll
- \d3d10.dll
- \d3d10core.dll
- \d3d10warp.dll
- \d3d11.dll
- \d3d12.dll
- \d3d9.dll
- \d3dx9_43.dll
- \dataexchange.dll
- \davclnt.dll
- \dcntel.dll
- \dcomp.dll
- \defragproxy.dll
- \desktopshellext.dll
- \deviceassociation.dll
- \devicecredential.dll
- \devicepairing.dll
- \devobj.dll
- \devrtl.dll
- \dhcpcmonitor.dll
- \dhcpcsvc.dll
- \dhcpcsvc6.dll
- \directmanipulation.dll
- \dismapi.dll
- \dismcore.dll
- \dmcfgutils.dll
- \dmcmnutils.dll
- \dmcommandlineutils.dll
- \dmenrollengine.dll
- \dmenterprisediagnostics.dll
- \dmiso8601utils.dll
- \dmoleaututils.dll
- \dmprocessxmlfiltered.dll
- \dmpushproxy.dll
- \dmxmlhelputils.dll
- \dnsapi.dll
- \dot3api.dll
- \dot3cfg.dll
- \dpx.dll
- \drprov.dll
- \drvstore.dll
- \dsclient.dll
- \dsparse.dll
- \dsprop.dll
- \dsreg.dll
- \dsrole.dll
- \dui70.dll
- \duser.dll
- \dusmapi.dll
- \dwmapi.dll
- \dwmcore.dll
- \dwrite.dll
- \dxcore.dll
- \dxgi.dll
- \dxva2.dll
- \dynamoapi.dll
- \eappcfg.dll
- \eappprxy.dll
- \edgeiso.dll
- \edputil.dll
- \efsadu.dll
- \efsutil.dll
- \esent.dll
- \execmodelproxy.dll
- \explorerframe.dll
- \fastprox.dll
- \faultrep.dll
- \fddevquery.dll
- \feclient.dll
- \fhcfg.dll
- \fhsvcctl.dll
- \firewallapi.dll
- \flightsettings.dll
- \fltlib.dll
- \framedynos.dll
- \fveapi.dll
- \fveskybackup.dll
- \fvewiz.dll
- \fwbase.dll
- \fwcfg.dll
- \fwpolicyiomgr.dll
- \fwpuclnt.dll
- \fxsapi.dll
- \fxsst.dll
- \fxstiff.dll
- \getuname.dll
- \gpapi.dll
- \hid.dll
- \hnetmon.dll
- \httpapi.dll
- \icmp.dll
- \idstore.dll
- \ieadvpack.dll
- \iedkcs32.dll
- \iernonce.dll
- \iertutil.dll
- \ifmon.dll
- \ifsutil.dll
- \inproclogger.dll
- \iphlpapi.dll
- \iri.dll
- \iscsidsc.dll
- \iscsium.dll
- \isv.exe_rsaenh.dll
- \iumbase.dll
- \iumsdk.dll
- \joinutil.dll
- \kdstub.dll
- \ksuser.dll
- \ktmw32.dll
- \licensemanagerapi.dll
- \licensingdiagspp.dll
- \linkinfo.dll
- \loadperf.dll
- \lockhostingframework.dll
- \logoncli.dll
- \logoncontroller.dll
- \lpksetupproxyserv.dll
- \lrwizdll.dll
- \magnification.dll
- \maintenanceui.dll
- \mapistub.dll
- \mbaexmlparser.dll
- \mdmdiagnostics.dll
- \mfc42u.dll
- \mfcore.dll
- \mfplat.dll
- \mi.dll
- \midimap.dll
- \mintdh.dll
- \miutils.dll
- \mlang.dll
- \mmdevapi.dll
- \mobilenetworking.dll
- \mpr.dll
- \mprapi.dll
- \mrmcorer.dll
- \msacm32.dll
- \mscms.dll
- \mscoree.dll
- \msctf.dll
- \msctfmonitor.dll
- \msdrm.dll
- \msdtctm.dll
- \msftedit.dll
- \msi.dll
- \msiso.dll
- \msutb.dll
- \msvcp110_win.dll
- \mswb7.dll
- \mswsock.dll
- \msxml3.dll
- \mtxclu.dll
- \napinsp.dll
- \ncrypt.dll
- \ndfapi.dll
- \netapi32.dll
- \netid.dll
- \netiohlp.dll
- \netjoin.dll
- \netplwiz.dll
- \netprofm.dll
- \netprovfw.dll
- \netsetupapi.dll
- \netshell.dll
- \nettrace.dll
- \netutils.dll
- \networkexplorer.dll
- \newdev.dll
- \ninput.dll
- \nlaapi.dll
- \nlansp_c.dll
- \npmproxy.dll
- \nshhttp.dll
- \nshipsec.dll
- \nshwfp.dll
- \ntdsapi.dll
- \ntlanman.dll
- \ntlmshared.dll
- \ntmarta.dll
- \ntshrui.dll
- \oleacc.dll
- \omadmapi.dll
- \onex.dll
- \opcservices.dll
- \osbaseln.dll
- \osksupport.dll
- \osuninst.dll
- \p2p.dll
- \p2pnetsh.dll
- \p9np.dll
- \pcaui.dll
- \pdh.dll
- \peerdistsh.dll
- \pkeyhelper.dll
- \pla.dll
- \playsndsrv.dll
- \pnrpnsp.dll
- \policymanager.dll
- \polstore.dll
- \powrprof.dll
- \printui.dll
- \prntvpt.dll
- \profapi.dll
- \propsys.dll
- \proximitycommon.dll
- \proximityservicepal.dll
- \prvdmofcomp.dll
- \puiapi.dll
- \radcui.dll
- \rasapi32.dll
- \rasdlg.dll
- \rasgcw.dll
- \rasman.dll
- \rasmontr.dll
- \reagent.dll
- \regapi.dll
- \reseteng.dll
- \resetengine.dll
- \resutils.dll
- \rmclient.dll
- \rpcnsh.dll
- \rsaenh.dll
- \rtutils.dll
- \rtworkq.dll
- \samcli.dll
- \samlib.dll
- \sapi_onecore.dll
- \sas.dll
- \scansetting.dll
- \scecli.dll
- \schedcli.dll
- \secur32.dll
- \security.dll
- \sensapi.dll
- \shell32.dll
- \shfolder.dll
- \slc.dll
- \snmpapi.dll
- \spectrumsyncclient.dll
- \spp.dll
- \sppc.dll
- \sppcext.dll
- \srclient.dll
- \srcore.dll
- \srmtrace.dll
- \srpapi.dll
- \srvcli.dll
- \ssp_isv.exe_rsaenh.dll
- \ssp.exe_rsaenh.dll
- \sspicli.dll
- \ssshim.dll
- \staterepository.core.dll
- \structuredquery.dll
- \sxshared.dll
- \systemsettings.dll
- \systemsettingsthresholdadminflowui.dll
- \tapi32.dll
- \tbs.dll
- \tdh.dll
- \textshaping.dll
- \timesync.dll
- \tpmcoreprovisioning.dll
- \tquery.dll
- \tsworkspace.dll
- \ttdrecord.dll
- \twext.dll
- \twinapi.dll
- \twinui.appcore.dll
- \uianimation.dll
- \uiautomationcore.dll
- \uireng.dll
- \uiribbon.dll
- \umpdc.dll
- \unattend.dll
- \updatepolicy.dll
- \upshared.dll
- \urlmon.dll
- \userenv.dll
- \utildll.dll
- \uxinit.dll
- \uxtheme.dll
- \vaultcli.dll
- \vdsutil.dll
- \version.dll
- \virtdisk.dll
- \vssapi.dll
- \vsstrace.dll
- \wbemprox.dll
- \wbemsvc.dll
- \wcmapi.dll
- \wcnnetsh.dll
- \wdi.dll
- \wdscore.dll
- \webservices.dll
- \wecapi.dll
- \wer.dll
- \wevtapi.dll
- \whhelper.dll
- \wimgapi.dll
- \winbio.dll
- \winbrand.dll
- \windows.storage.dll
- \windows.storage.search.dll
- \windows.ui.immersive.dll
- \windowscodecs.dll
- \windowscodecsext.dll
- \windowsudk.shellcommon.dll
- \winhttp.dll
- \wininet.dll
- \winipsec.dll
- \winmde.dll
- \winmm.dll
- \winnsi.dll
- \winrnr.dll
- \winscard.dll
- \winsqlite3.dll
- \winsta.dll
- \winsync.dll
- \wkscli.dll
- \wlanapi.dll
- \wlancfg.dll
- \wldp.dll
- \wlidprov.dll
- \wmiclnt.dll
- \wmidcom.dll
- \wmiutils.dll
- \wmpdui.dll
- \wmsgapi.dll
- \wofutil.dll
- \wpdshext.dll
- \wscapi.dll
- \wsdapi.dll
- \wshbth.dll
- \wshelper.dll
- \wsmsvc.dll
- \wtsapi32.dll
- \wwancfg.dll
- \wwapi.dll
- \xmllite.dll
- \xolehlp.dll
- \xpsservices.dll
- \xwizards.dll
- \xwtpw32.dll
- \amsi.dll
- \appraiser.dll
- \COMRES.DLL
- \cryptnet.dll
- \DispBroker.dll
- \dsound.dll
- \dxilconv.dll
- \FxsCompose.dll
- \FXSRESM.DLL
- \msdtcVSp1res.dll
- \PrintIsolationProxy.dll
- \rdpendp.dll
- \rpchttp.dll
- \storageusage.dll
- \utcutil.dll
- \WfsR.dll
- \igd10iumd64.dll
- \igd12umd64.dll
- \igdumdim64.dll
- \igdusc64.dll
- \TSMSISrv.dll
- \TSVIPSrv.dll
- \wbemcomn.dll
- \WLBSCTRL.dll
- \wow64log.dll
- \WptsExtensions.dll
filter_main_generic:
ImageLoaded|contains:
- C:\$WINDOWS.~BT\
- C:\$WinREAgent\
- C:\Windows\SoftwareDistribution\
- C:\Windows\System32\
- C:\Windows\SystemTemp\
- C:\Windows\SysWOW64\
- C:\Windows\WinSxS\
- C:\Windows\SyChpe32\
filter_main_windows_temp:
ImageLoaded|startswith: C:\Windows\Temp\
Image|startswith:
- C:\Windows\WinSxS\arm64
- C:\Windows\UUS\arm64\
Image|endswith:
- \TiWorker.exe
- \wuaucltcore.exe
filter_main_dot_net:
ImageLoaded|startswith: C:\Windows\Microsoft.NET\
ImageLoaded|endswith: \cscui.dll
filter_main_defender:
ImageLoaded|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\
ImageLoaded|endswith: \version.dll
filter_main_directx:
ImageLoaded|startswith: C:\Program Files\WindowsApps\Microsoft.DirectXRuntime_
ImageLoaded|endswith: \d3dx9_43.dll
filter_main_systemsettings:
ImageLoaded: C:\Windows\ImmersiveControlPanel\SystemSettings.dll
filter_optional_exchange:
ImageLoaded|startswith: C:\Program Files\Microsoft\Exchange Server\
ImageLoaded|endswith: \mswb7.dll
filter_optional_arsenal_image_mounter:
ImageLoaded|startswith: C:\Program Files\Arsenal-Image-Mounter-
ImageLoaded|endswith:
- \mi.dll
- \miutils.dl
filter_optional_office_appvpolicy:
Image: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
ImageLoaded: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll
filter_optional_azure:
ImageLoaded|startswith: C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\
filter_optional_dell:
Image|contains:
- C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs
- C:\Windows\System32\backgroundTaskHost.exe
ImageLoaded|startswith: C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs
filter_optional_dell_wldp:
ImageLoaded|startswith: C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs
ImageLoaded|endswith: \wldp.dll
filter_optional_checkpoint:
Image|startswith:
- C:\Program Files\CheckPoint\
- C:\Program Files (x86)\CheckPoint\
Image|endswith: \SmartConsole.exe
ImageLoaded|startswith:
- C:\Program Files\CheckPoint\
- C:\Program Files (x86)\CheckPoint\
ImageLoaded|endswith: \PolicyManager.dll
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate applications loading their own versions of the DLLs mentioned in this rule
level: high
license: DRL-1.1
related:
- id: 4fc0deee-0057-4998-ab31-d24e46e0aba4
type: derived
What it detects
This rule flags cases where Windows loads DLLs commonly associated with system components by matching their names in ImageLoaded telemetry. DLL sideloading matters because attackers can place or reference malicious copies of “legitimate” DLLs so a trusted process loads attacker-controlled code. The detection relies on the image load events (ImageLoaded) and narrows results by excluding common legitimate system and software-cache paths via allowlist-style filters.
Known false positives
- Legitimate applications loading their own versions of the DLLs mentioned in this rule
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.