Windows DLL Sideloading: goopdate.dll Loaded from Nonstandard Paths
Alerts when goopdate.dll is loaded from non-standard locations, suggesting possible DLL sideloading behavior on Windows.
- Product
- windows
- Category
- image_load
- Author
- X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-15
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags image loads of goopdate.dll when the loaded DLL path ends with \goopdate.dll, excluding common install directories and specific temporary installer patterns. Attackers may use DLL sideloading by causing a legitimate executable to load a malicious or replaced DLL from an unexpected location. It relies on Windows image load telemetry (ImageLoaded) to identify the loaded module path and apply path-based filters to reduce noise.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows DLL Sideloading: goopdate.dll Loaded from Nonstandard Paths"
id: f09e927e-6dd6-459e-9b90-3cd5945e8ea8
status: test
description: This rule flags image loads of goopdate.dll when the loaded DLL path ends with \goopdate.dll, excluding common install directories and specific temporary installer patterns. Attackers may use DLL sideloading by causing a legitimate executable to load a malicious or replaced DLL from an unexpected location. It relies on Windows image load telemetry (ImageLoaded) to identify the loaded module path and apply path-based filters to reduce noise.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_goopdate.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
modified: 2025-10-07
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: \goopdate.dll
filter_main_generic:
ImageLoaded|startswith:
- C:\Program Files (x86)\
- C:\Program Files\
filter_optional_dropbox_installer_temp:
Image|contains|all:
- \AppData\Local\Temp\GUM
- .tmp\Dropbox
ImageLoaded|contains|all:
- \AppData\Local\Temp\GUM
- .tmp\goopdate.dll
filter_optional_googleupdate_temp:
Image|contains:
- \AppData\Local\Temp\GUM
- :\Windows\SystemTemp\GUM
Image|endswith: .tmp\GoogleUpdate.exe
ImageLoaded|contains:
- \AppData\Local\Temp\GUM
- :\Windows\SystemTemp\GUM
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- False positives are expected from Google Chrome installations running from user locations (AppData) and other custom locations. Apply additional filters accordingly.
- Other third party chromium browsers located in AppData
level: medium
license: DRL-1.1
related:
- id: b6188d2f-b3c4-4d2c-a17d-9706e0851af0
type: derived