Windows DLL sideloading via AVKkid.dll image loads
Identifies suspicious AVKkid.dll loads on Windows that may indicate DLL sideloading, excluding a specific likely legitimate path pattern.
- Product
- windows
- Category
- image_load
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-03
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows image load events where the loaded module path ends with AVKkid.dll, which can indicate DLL sideloading. Attackers use this technique to force a legitimate process to load a malicious or unexpected DLL, enabling persistence, execution, or stealth. The detection relies on image load telemetry and excludes cases where AVKKid.exe is loaded from specific “G DATA” program directories.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DLL sideloading via AVKkid.dll image loads
id: 55ac0c53-1393-41ae-a4d2-3c31204b3a6a
status: test
description: This rule flags Windows image load events where the loaded module path ends with AVKkid.dll, which can indicate DLL sideloading. Attackers use this technique to force a legitimate process to load a malicious or unexpected DLL, enabling persistence, execution, or stealth. The detection relies on image load telemetry and excludes cases where AVKKid.exe is loaded from specific “G DATA” program directories.
references:
- https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_avkkid.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-08-03
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: \AVKkid.dll
filter_main_legit_path:
Image|contains:
- C:\Program Files (x86)\G DATA\
- C:\Program Files\G DATA\
Image|endswith: \AVKKid.exe
ImageLoaded|startswith:
- C:\Program Files (x86)\G DATA\
- C:\Program Files\G DATA\
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 952ed57c-8f99-453d-aee0-53a49c22f95d
type: derived