Windows DLL Hijacking via Forced Load of C:\Windows\ADFS\version.dll

Alert on loading C:\Windows\ADFS\version.dll, a DLL hijacking indicator consistent with the FoggyWeb technique.

FreeReviewedSigma · Critical · v5
Product
windows
Category
image_load
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-09-27
Updated
2026-07-31

ATT&CK techniques

Resource Dev
  1. Recon

  2. Initial Access

  3. Execution

  4. Persistence

  5. Priv Esc

  6. Defense Evasion

  7. Cred Access

  8. Discovery

  9. Lateral Movement

  10. Collection

  11. C2

  12. Exfiltration

  13. Impact

What it detects

This rule flags image load events where the process loads C:\Windows\ADFS\version.dll from the ADFS directory. Loading an unexpected or malicious DLL under a legitimate name is a common DLL hijacking technique that can provide attackers code execution within a trusted process context. It relies on Windows image load telemetry that records the fully qualified DLL path loaded by a process.

Related detections5 linkedT1587 — drag to rearrange
Linux process execution matches known hacktools by image name
Windows Winword.exe Creates INetCache .cab and .inf Files During CVE-2021-40444 Exploitation
Windows File Events: PoC Filename Pattern for CVE-2021-1675 Spooler Exploitation
Windows Execution of PurpleSharp HackTool by Image Name or Executable Metadata
Linux Auditd: Program Executions from Suspicious Web and Data Directories
Windows DLL Hijacking via Forced Load of C:\Windows\ADFS\version.dll
Pivot detection · T1587 · 5 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.