Windows DLL Sideloading via ImageLoad from Lenovo and Toshiba Third-Party Directories

title: Windows DLL Sideloading via ImageLoad from Lenovo and Toshiba Third-Party Directories
id: d7188b7c-8845-432f-9e43-f216dd044933
status: test
description: This rule identifies DLL sideloading behavior on Windows by flagging ImageLoad events for specific third-party DLL names (commfunc.dll on Lenovo and tos btkbd.dll on Toshiba). It matters because attackers can load malicious DLLs from user-writable or unexpected paths when a legitimate application attempts to load these libraries. The detection relies on Windows image load telemetry, matching DLL file names while excluding expected installation directories using path-based filters.
references:
  - https://hijacklibs.net/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_third_party.yml
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research), Huntrule Team
date: 2022-08-17
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection_lenovo:
    ImageLoaded|endswith: \commfunc.dll
  filter_lenovo:
    - ImageLoaded|contains: \AppData\local\Google\Chrome\Application\
    - ImageLoaded|startswith:
        - C:\Program Files\Lenovo\Communications Utility\
        - C:\Program Files (x86)\Lenovo\Communications Utility\
  selection_toshiba:
    ImageLoaded|endswith: \tosbtkbd.dll
  filter_toshiba:
    ImageLoaded|startswith:
      - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\
      - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\
  condition: (selection_lenovo and not filter_lenovo) or (selection_toshiba and not filter_toshiba)
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: f9df325d-d7bc-4a32-8a1a-2cc61dcefc63
    type: derived