Windows DLL Sideloading via ShellDispatch.dll Image Load

Alerts on suspicious loads of ShellDispatch.dll on Windows when not occurring in expected temp directories.

FreeUnreviewedSigmamediumv1

windows-dll-sideloading-via-shelldispatch-dll-image-load-844f8eb2

title: Windows DLL Sideloading via ShellDispatch.dll Image Load
id: d8aae591-a1a2-4d1e-b921-bdd8a16cc607
status: test
description: This rule flags Windows process image load events where the loaded module path ends with "\ShellDispatch.dll" and the load does not match specified temporary-folder patterns. Attackers may abuse DLL sideloading to execute malicious code through a trusted-looking DLL name. The detection relies on Windows image_load telemetry that includes the full ImageLoaded path for loaded modules.
references:
  - https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_shelldispatch.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-20
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \ShellDispatch.dll
  filter_main_legit_path:
    - ImageLoaded|contains|all:
        - :\Users\
        - \AppData\Local\Temp\
    - ImageLoaded|contains: :\Windows\Temp\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Some installers may trigger some false positives
level: medium
license: DRL-1.1
related:
  - id: 844f8eb2-610b-42c8-89a4-47596e089663
    type: derived

What it detects

This rule flags Windows process image load events where the loaded module path ends with "\ShellDispatch.dll" and the load does not match specified temporary-folder patterns. Attackers may abuse DLL sideloading to execute malicious code through a trusted-looking DLL name. The detection relies on Windows image_load telemetry that includes the full ImageLoaded path for loaded modules.

Known false positives

Some installers may trigger some false positives

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.