Windows: Alerts for Potential Antivirus DLL Sideloading via Unusual DLL Loads

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1574.001DLL
Defense Evasion
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows image loads where specific DLL filenames commonly associated with antivirus products are loaded from unexpected directories. Attackers may abuse DLL sideloading to execute malicious code under the guise of legitimate security or related software components. The detection relies on telemetry that records loaded images and their full paths, matching DLL name suffixes and excluding known benign locations for multiple vendors.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

Malicious DLL Sideloading via consent.exe Loading msimg32.dll (via image_load)

Malicious Bumblebee DLL Sideload of msimg32 by consent from Non-System Path (via image_load)

Suspicious BugSplat Binary Sideloading bugsplatrc.dll via DLL Search Order Hijack

Suspicious SentinelOne Binary Sideloading sentinelagentcore.dll

Suspicious 7-Zip Executable Sideloading 7z.dll Loader

Suspicious Loading of Masqueraded EndpointDlp.dll Backdoor

Suspicious Trend Micro Binary Sideloading tmdglog.dll

Suspicious DLL Sideloading via ProtonVPN Executable (via image_load)

Suspicious DLL Sideloading via OneDriveStandaloneUpdater (via image_load)

Windows: Alerts for Potential Antivirus DLL Sideloading via Unusual DLL Loads

Pivot detection · T1574.001 · 9 related

Changelog

v4

v4
Candidate ingested via manual entry.2026-10-19
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-image-load-alerts-for-dll-sideloading-from-security-product-directories-552b6b65

title: "Windows: Alerts for Potential Antivirus DLL Sideloading via Unusual DLL Loads"
id: 2bcf12ae-76a8-4e89-ba40-273993a968cd
status: test
description: This rule flags Windows image loads where specific DLL filenames commonly associated with antivirus products are loaded from unexpected directories. Attackers may abuse DLL sideloading to execute malicious code under the guise of legitimate security or related software components. The detection relies on telemetry that records loaded images and their full paths, matching DLL name suffixes and excluding known benign locations for multiple vendors.
references:
  - https://hijacklibs.net/
  - https://www.huntress.com/blog/clickfix-matanbuchus-astarionrat-analysis
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_antivirus.yml
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research), Huntrule Team
date: 2022-08-17
modified: 2026-10-19
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection_bitdefender:
    ImageLoaded|endswith: \log.dll
  filter_log_dll_bitdefender:
    ImageLoaded|startswith:
      - C:\Program Files\Bitdefender Antivirus Free\
      - C:\Program Files (x86)\Bitdefender Antivirus Free\
  filter_log_dll_dell_sar:
    Image: C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe
    ImageLoaded:
      - C:\Program Files\Dell\SARemediation\plugin\log.dll
      - C:\Program Files\Dell\SARemediation\audit\log.dll
  filter_log_dll_canon:
    ImageLoaded|startswith: C:\Program Files\Canon\MyPrinter\
  filter_log_dll_avast:
    ImageLoaded:
      - C:\Program Files\AVAST Software\Avast\log.dll
      - C:\Program Files (x86)\AVAST Software\Avast\log.dll
  filter_log_dll_avg:
    ImageLoaded:
      - C:\Program Files\AVG\Antivirus\log.dll
      - C:\Program Files (x86)\AVG\Antivirus\log.dll
  selection_fsecure:
    ImageLoaded|endswith: \qrt.dll
  filter_fsecure:
    ImageLoaded|startswith:
      - C:\Program Files\F-Secure\Anti-Virus\
      - C:\Program Files (x86)\F-Secure\Anti-Virus\
  selection_mcafee:
    ImageLoaded|endswith:
      - \ashldres.dll
      - \lockdown.dll
      - \vsodscpl.dll
  filter_mcafee:
    ImageLoaded|startswith:
      - C:\Program Files\McAfee\
      - C:\Program Files (x86)\McAfee\
  selection_cyberark:
    ImageLoaded|endswith: \vftrace.dll
  filter_cyberark:
    ImageLoaded|startswith:
      - C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\
      - C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32\
  selection_avast:
    ImageLoaded|endswith: \wsc.dll
  filter_wsc_dll_avast:
    ImageLoaded|startswith:
      - C:\Program Files\AVAST Software\Avast\
      - C:\Program Files (x86)\AVAST Software\Avast\
  filter_wsc_dll_avg:
    ImageLoaded|startswith:
      - C:\Program Files\AVG\Antivirus\
      - C:\Program Files (x86)\AVG\Antivirus\
  selection_eset_deslock:
    ImageLoaded|endswith: \DLPPREM32.dll
  filter_eset_deslock:
    ImageLoaded|startswith:
      - C:\Program Files\ESET
      - C:\Program Files (x86)\ESET
  selection_titanium:
    ImageLoaded|endswith: \tmdbglog.dll
  filter_titanium:
    ImageLoaded|startswith:
      - C:\Program Files\Trend Micro\Titanium\
      - C:\Program Files (x86)\Trend Micro\Titanium\
  selection_zillya:
    ImageLoaded|endswith: \SystemStatus.dll
  filter_zillya_ovron:
    ImageLoaded|startswith:
      - C:\Program Files\Zillya Antivirus\
      - C:\Program Files (x86)\Zillya Antivirus\
      - C:\Program Files\Zillya Total Security\
      - C:\Program Files (x86)\Zillya Total Security\
      - C:\Program Files\Ovron Total Security\
      - C:\Program Files (x86)\Ovron Total Security\
  condition: (selection_bitdefender and not 1 of filter_log_dll_*) or (selection_fsecure and not filter_fsecure) or (selection_mcafee and not filter_mcafee) or (selection_cyberark and not filter_cyberark) or (selection_avast and not 1 of filter_wsc_dll_*) or (selection_titanium and not filter_titanium) or (selection_eset_deslock and not filter_eset_deslock) or (selection_zillya and not filter_zillya_ovron)
falsepositives:
  - Applications that load the same dlls mentioned in the detection section. Investigate them and filter them out if a lot FPs are caused.
  - Dell SARemediation plugin folder (C:\Program Files\Dell\SARemediation\plugin\log.dll) is known to contain the 'log.dll' file.
  - The Canon MyPrinter folder 'C:\Program Files\Canon\MyPrinter\' is known to contain the 'log.dll' file
level: medium
license: DRL-1.1
related:
  - id: 552b6b65-df37-4d3e-a258-f2fc4771ae54
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL