Windows DLL Sideloading via goopdate.dll ImageLoad

Alerts when goopdate.dll is loaded from non-standard locations, suggesting possible DLL sideloading behavior on Windows.

FreeUnreviewedSigmamediumv1

windows-dll-sideloading-via-goopdate-dll-imageload-b6188d2f

title: Windows DLL Sideloading via goopdate.dll ImageLoad
id: f09e927e-6dd6-459e-9b90-3cd5945e8ea8
status: test
description: This rule flags Windows image loads where the loaded file path ends with goopdate.dll, a library associated with googleupdate.exe, indicating potential DLL sideloading. Sideloading is a common attacker technique to get malicious code loaded into a legitimate process by placing or triggering a lookalike DLL. The detection relies on image_load telemetry capturing ImageLoaded paths and applies exclusions for common program locations and specific temporary download patterns.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_goopdate.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
modified: 2025-10-07
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \goopdate.dll
  filter_main_generic:
    ImageLoaded|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
  filter_optional_dropbox_installer_temp:
    Image|contains|all:
      - \AppData\Local\Temp\GUM
      - .tmp\Dropbox
    ImageLoaded|contains|all:
      - \AppData\Local\Temp\GUM
      - .tmp\goopdate.dll
  filter_optional_googleupdate_temp:
    Image|contains:
      - \AppData\Local\Temp\GUM
      - :\Windows\SystemTemp\GUM
    Image|endswith: .tmp\GoogleUpdate.exe
    ImageLoaded|contains:
      - \AppData\Local\Temp\GUM
      - :\Windows\SystemTemp\GUM
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - False positives are expected from Google Chrome installations running from user locations (AppData) and other custom locations. Apply additional filters accordingly.
  - Other third party chromium browsers located in AppData
level: medium
license: DRL-1.1
related:
  - id: b6188d2f-b3c4-4d2c-a17d-9706e0851af0
    type: derived

What it detects

This rule flags Windows image loads where the loaded file path ends with goopdate.dll, a library associated with googleupdate.exe, indicating potential DLL sideloading. Sideloading is a common attacker technique to get malicious code loaded into a legitimate process by placing or triggering a lookalike DLL. The detection relies on image_load telemetry capturing ImageLoaded paths and applies exclusions for common program locations and specific temporary download patterns.

Known false positives

False positives are expected from Google Chrome installations running from user locations (AppData) and other custom locations. Apply additional filters accordingly.
Other third party chromium browsers located in AppData

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.