Windows DLL Sideloading Using Antivirus/Vendor DLLs Based on Loaded Image Names
Alerts on suspicious DLL loads matching known antivirus/security component DLL names when not from expected vendor paths.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- image_load
- Author
- Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) (SigmaHQ), DRL 1.1
- Published
- 2022-08-17
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags potential DLL sideloading on Windows by matching image-loaded DLLs associated with specific security and vendor products (e.g., Bitdefender, F-Secure, McAfee, CyberArk, Avast, ESET, Trend Micro). DLL sideloading is a common technique to execute attacker-controlled code when a process loads a DLL by name, path, or search order. It relies on image-load telemetry (ImageLoaded) and filters out known benign locations for the matched DLLs using hardcoded program path prefixes and specific executable context where applicable.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-image-load-alerts-for-dll-sideloading-from-security-product-directories-552b6b65
title: Windows DLL Sideloading Using Antivirus/Vendor DLLs Based on Loaded Image Names
id: 2bcf12ae-76a8-4e89-ba40-273993a968cd
status: test
description: This rule flags potential DLL sideloading on Windows by matching image-loaded DLLs associated with specific security and vendor products (e.g., Bitdefender, F-Secure, McAfee, CyberArk, Avast, ESET, Trend Micro). DLL sideloading is a common technique to execute attacker-controlled code when a process loads a DLL by name, path, or search order. It relies on image-load telemetry (ImageLoaded) and filters out known benign locations for the matched DLLs using hardcoded program path prefixes and specific executable context where applicable.
references:
- https://hijacklibs.net/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_antivirus.yml
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research), Huntrule Team
date: 2022-08-17
modified: 2025-10-07
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection_bitdefender:
ImageLoaded|endswith: \log.dll
filter_log_dll_bitdefender:
ImageLoaded|startswith:
- C:\Program Files\Bitdefender Antivirus Free\
- C:\Program Files (x86)\Bitdefender Antivirus Free\
filter_log_dll_dell_sar:
Image: C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe
ImageLoaded:
- C:\Program Files\Dell\SARemediation\plugin\log.dll
- C:\Program Files\Dell\SARemediation\audit\log.dll
filter_log_dll_canon:
ImageLoaded|startswith: C:\Program Files\Canon\MyPrinter\
filter_log_dll_avast:
ImageLoaded:
- C:\Program Files\AVAST Software\Avast\log.dll
- C:\Program Files (x86)\AVAST Software\Avast\log.dll
filter_log_dll_avg:
ImageLoaded:
- C:\Program Files\AVG\Antivirus\log.dll
- C:\Program Files (x86)\AVG\Antivirus\log.dll
selection_fsecure:
ImageLoaded|endswith: \qrt.dll
filter_fsecure:
ImageLoaded|startswith:
- C:\Program Files\F-Secure\Anti-Virus\
- C:\Program Files (x86)\F-Secure\Anti-Virus\
selection_mcafee:
ImageLoaded|endswith:
- \ashldres.dll
- \lockdown.dll
- \vsodscpl.dll
filter_mcafee:
ImageLoaded|startswith:
- C:\Program Files\McAfee\
- C:\Program Files (x86)\McAfee\
selection_cyberark:
ImageLoaded|endswith: \vftrace.dll
filter_cyberark:
ImageLoaded|startswith:
- C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\
- C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32\
selection_avast:
ImageLoaded|endswith: \wsc.dll
filter_wsc_dll_avast:
ImageLoaded|startswith:
- C:\program Files\AVAST Software\Avast\
- C:\program Files (x86)\AVAST Software\Avast\
filter_wsc_dll_avg:
ImageLoaded|startswith:
- C:\Program Files\AVG\Antivirus\
- C:\Program Files (x86)\AVG\Antivirus\
selection_eset_deslock:
ImageLoaded|endswith: \DLPPREM32.dll
filter_eset_deslock:
ImageLoaded|startswith:
- C:\program Files\ESET
- C:\program Files (x86)\ESET
selection_titanium:
ImageLoaded|endswith: \tmdbglog.dll
filter_titanium:
ImageLoaded|startswith:
- C:\program Files\Trend Micro\Titanium\
- C:\program Files (x86)\Trend Micro\Titanium\
condition: (selection_bitdefender and not 1 of filter_log_dll_*) or (selection_fsecure and not filter_fsecure) or (selection_mcafee and not filter_mcafee) or (selection_cyberark and not filter_cyberark) or (selection_avast and not 1 of filter_wsc_dll_*) or (selection_titanium and not filter_titanium) or (selection_eset_deslock and not filter_eset_deslock)
falsepositives:
- Applications that load the same dlls mentioned in the detection section. Investigate them and filter them out if a lot FPs are caused.
- Dell SARemediation plugin folder (C:\Program Files\Dell\SARemediation\plugin\log.dll) is known to contain the 'log.dll' file.
- The Canon MyPrinter folder 'C:\Program Files\Canon\MyPrinter\' is known to contain the 'log.dll' file
level: medium
license: DRL-1.1
related:
- id: 552b6b65-df37-4d3e-a258-f2fc4771ae54
type: derived