Windows DLL sideloading via third-party application directories (ImageLoad event)
Flags Windows ImageLoad events for specific DLL sideloading candidates tied to Lenovo and Toshiba software.
- Product
- windows
- Category
- image_load
- Author
- Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) (SigmaHQ), DRL 1.1
- Published
- 2022-08-17
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows processes loading specific DLL filenames commonly associated with third-party software from unexpected, non-vetted paths. DLL sideloading is a stealthy persistence and execution technique because a malicious or replaced DLL can be loaded in the context of a trusted application. It relies on image load telemetry that includes the loaded DLL path (ImageLoaded) to match on DLL name endings and to exclude known legitimate installation directory paths for Lenovo and Toshiba.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DLL sideloading via third-party application directories (ImageLoad event)
id: d7188b7c-8845-432f-9e43-f216dd044933
status: test
description: This rule flags Windows processes loading specific DLL filenames commonly associated with third-party software from unexpected, non-vetted paths. DLL sideloading is a stealthy persistence and execution technique because a malicious or replaced DLL can be loaded in the context of a trusted application. It relies on image load telemetry that includes the loaded DLL path (ImageLoaded) to match on DLL name endings and to exclude known legitimate installation directory paths for Lenovo and Toshiba.
references:
- https://hijacklibs.net/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_third_party.yml
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research), Huntrule Team
date: 2022-08-17
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection_lenovo:
ImageLoaded|endswith: \commfunc.dll
filter_lenovo:
- ImageLoaded|contains: \AppData\local\Google\Chrome\Application\
- ImageLoaded|startswith:
- C:\Program Files\Lenovo\Communications Utility\
- C:\Program Files (x86)\Lenovo\Communications Utility\
selection_toshiba:
ImageLoaded|endswith: \tosbtkbd.dll
filter_toshiba:
ImageLoaded|startswith:
- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\
- C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\
condition: (selection_lenovo and not filter_lenovo) or (selection_toshiba and not filter_toshiba)
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: f9df325d-d7bc-4a32-8a1a-2cc61dcefc63
type: derived