Windows: Potential DLL sideloading via VMwareXferlogs loading glib-2.0.dll from non-standard path

Alerts on VMwareXferlogs.exe loading glib-2.0.dll from outside the default VMware directory.

FreeReviewedSigma · High · v2

Product: windows
Category: image_load
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-08-02
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1574.001DLL
Defense Evasion
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags instances where VMwareXferlogs.exe loads glib-2.0.dll when the loaded DLL is not located under the default VMware installation directory. Attackers may use DLL sideloading to execute malicious code by leveraging a legitimate VMware component. The detection relies on Windows image load telemetry that records the loading process path (Image) and the full/relative path of the loaded DLL (ImageLoaded).

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)

Suspicious Cortex XDR Binary Sideloading winutils.dll (via image_load)

Suspicious CoinLoader DLL Sideload From Z-1-36-81 Directory (via image_load)

Suspicious shfolder.dll Sideloading via VMware net-service Binary

Windows: Potential DLL sideloading via VMwareXferlogs loading glib-2.0.dll from non-standard path

Pivot detection · T1574.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-flag-vmwarexferlogs-exe-loading-glib-2-0-dll-from-non-default-path-9313dc13

title: "Windows: Potential DLL sideloading via VMwareXferlogs loading glib-2.0.dll from non-standard path"
id: 6a772100-64a2-4f2f-82d3-683c29580bfc
status: test
description: This rule flags instances where VMwareXferlogs.exe loads glib-2.0.dll when the loaded DLL is not located under the default VMware installation directory. Attackers may use DLL sideloading to execute malicious code by leveraging a legitimate VMware component. The detection relies on Windows image load telemetry that records the loading process path (Image) and the full/relative path of the loaded DLL (ImageLoaded).
references:
  - https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_vmware_xfer.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-02
modified: 2023-02-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    Image|endswith: \VMwareXferlogs.exe
    ImageLoaded|endswith: \glib-2.0.dll
  filter:
    ImageLoaded|startswith: C:\Program Files\VMware\
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 9313dc13-d04c-46d8-af4a-a930cc55d93b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL