huntrule

Windows DLL sideloading via iviewers.dll image loads

Alerts on unexpected loads of iviewers.dll outside Windows Kits paths, consistent with DLL sideloading attempts.

FreeUnreviewedSigmahighv1
title: Windows DLL sideloading via iviewers.dll image loads
id: e20f1c5c-047a-4f48-81a7-0bc5b674818d
status: test
description: Flags Windows processes that load a DLL named "iviewers.dll" where the module load path is not under the Windows Kits directories. Loading this DLL name can indicate an attempt to hijack DLL search order or sideload a malicious or substituted library. This detection relies on image load telemetry that records the full DLL path for DLLs loaded by a process.
references:
  - https://www.secureworks.com/research/shadowpad-malware-analysis
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_iviewers.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-03-21
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \iviewers.dll
  filter:
    ImageLoaded|startswith:
      - C:\Program Files (x86)\Windows Kits\
      - C:\Program Files\Windows Kits\
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4c21b805-4dd7-469f-b47d-7383a8fcb437
    type: derived

What it detects

Flags Windows processes that load a DLL named "iviewers.dll" where the module load path is not under the Windows Kits directories. Loading this DLL name can indicate an attempt to hijack DLL search order or sideload a malicious or substituted library. This detection relies on image load telemetry that records the full DLL path for DLLs loaded by a process.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.