Windows DLL Sideloading via SmadHook32c.dll and SmadHook64c.dll Loads
Alerts on non-standard loads of SmadHook32c.dll/SmadHook64c.dll on Windows, consistent with potential DLL sideloading.
- Product
- windows
- Category
- image_load
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-01
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows image loads of SmadHook32c.dll or SmadHook64c.dll while excluding loads originating from the SMADAV product executable paths. Such DLL sideloading can be used by attackers to execute malicious code under the context of a legitimate process by placing or triggering a spoofed dependency. Telemetry required includes image-load events (ImageLoaded) on Windows, and process/image path context to filter known legitimate SMADAV binaries.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DLL Sideloading via SmadHook32c.dll and SmadHook64c.dll Loads
id: 1a08f74d-a85a-4d0a-b48b-36096fe630ac
status: test
description: This rule identifies Windows image loads of SmadHook32c.dll or SmadHook64c.dll while excluding loads originating from the SMADAV product executable paths. Such DLL sideloading can be used by attackers to execute malicious code under the context of a legitimate process by placing or triggering a spoofed dependency. Telemetry required includes image-load events (ImageLoaded) on Windows, and process/image path context to filter known legitimate SMADAV binaries.
references:
- https://research.checkpoint.com/2023/malware-spotlight-camaro-dragons-tinynote-backdoor/
- https://www.qurium.org/alerts/targeted-malware-against-crph/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_smadhook.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-01
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith:
- \SmadHook32c.dll
- \SmadHook64c.dll
filter_main_legit_path:
Image:
- C:\Program Files (x86)\SMADAV\SmadavProtect32.exe
- C:\Program Files (x86)\SMADAV\SmadavProtect64.exe
- C:\Program Files\SMADAV\SmadavProtect32.exe
- C:\Program Files\SMADAV\SmadavProtect64.exe
ImageLoaded|startswith:
- C:\Program Files (x86)\SMADAV\
- C:\Program Files\SMADAV\
condition: selection and not 1 of filter_main_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 24b6cf51-6122-469e-861a-22974e9c1e5b
type: derived