Windows DLL Sideloading via ImageLoad of mscoRee/colorui/mapistub/HID payload DLLs
Alerts on Windows processes loading DLLs from targeted ProgramShared/ProgramData paths consistent with DLL sideloading.
- Product
- windows
- Category
- image_load
- Author
- Thurein Oo, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-10-18
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows processes loading DLLs from same-named application search paths that commonly indicate trojanized DLL sideloading behavior. Such activity matters because attackers can execute malicious code by placing or replacing DLLs that legitimate binaries load at runtime. Telemetry relies on image load events that record the parent process image path and the loaded DLL path.
Reporting behind it
- welivesecurity.comhttps://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/lazarus-hackers-breach-aerospace-firm-with-new-lightlesscan-malware/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Lazarus/image_load_apt_lazarus_side_load_activity.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DLL Sideloading via ImageLoad of mscoRee/colorui/mapistub/HID payload DLLs
id: 7a2fcf7f-c1a3-4f1d-8835-7735a7b3702d
status: test
description: This rule identifies Windows processes loading DLLs from same-named application search paths that commonly indicate trojanized DLL sideloading behavior. Such activity matters because attackers can execute malicious code by placing or replacing DLLs that legitimate binaries load at runtime. Telemetry relies on image load events that record the parent process image path and the loaded DLL path.
references:
- https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/
- https://www.bleepingcomputer.com/news/security/lazarus-hackers-breach-aerospace-firm-with-new-lightlesscan-malware/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Lazarus/image_load_apt_lazarus_side_load_activity.yml
author: Thurein Oo, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-18
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1574.001
- attack.g0032
- detection.emerging-threats
logsource:
product: windows
category: image_load
detection:
selection_mscoree:
Image: C:\ProgramShared\PresentationHost.exe
ImageLoaded: :\ProgramShared\mscoree.dll
selection_colorui:
Image: C:\ProgramData\Adobe\colorcpl.exe
ImageLoaded: C:\ProgramData\Adobe\colorui.dll
selection_mapistub:
Image: C:\ProgramData\Oracle\Java\fixmapi.exe
ImageLoaded: C:\ProgramData\Oracle\Java\mapistub.dll
selection_hid:
Image: C:\ProgramData\Adobe\ARM\tabcal.exe
ImageLoaded: C:\ProgramData\Adobe\ARM\HID.dll
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 24007168-a26b-4049-90d0-ce138e13a5cf
type: derived