Windows DLL Sideloading Using Antivirus/Vendor DLLs Based on Loaded Image Names

Alerts on suspicious DLL loads matching known antivirus/security component DLL names when not from expected vendor paths.

FreeReviewedSigma · Medium · v2

Product: windows
Category: image_load
Author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) (SigmaHQ), DRL 1.1
Published: 2022-08-17
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1574.001DLL
Defense Evasion
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags potential DLL sideloading on Windows by matching image-loaded DLLs associated with specific security and vendor products (e.g., Bitdefender, F-Secure, McAfee, CyberArk, Avast, ESET, Trend Micro). DLL sideloading is a common technique to execute attacker-controlled code when a process loads a DLL by name, path, or search order. It relies on image-load telemetry (ImageLoaded) and filters out known benign locations for the matched DLLs using hardcoded program path prefixes and specific executable context where applicable.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

Suspicious msimg32.dll Loaded from Non-System Directory

DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)

Suspicious Cortex XDR Binary Sideloading winutils.dll (via image_load)

Windows DLL Sideloading Using Antivirus/Vendor DLLs Based on Loaded Image Names

Pivot detection · T1574.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-image-load-alerts-for-dll-sideloading-from-security-product-directories-552b6b65

title: Windows DLL Sideloading Using Antivirus/Vendor DLLs Based on Loaded Image Names
id: 2bcf12ae-76a8-4e89-ba40-273993a968cd
status: test
description: This rule flags potential DLL sideloading on Windows by matching image-loaded DLLs associated with specific security and vendor products (e.g., Bitdefender, F-Secure, McAfee, CyberArk, Avast, ESET, Trend Micro). DLL sideloading is a common technique to execute attacker-controlled code when a process loads a DLL by name, path, or search order. It relies on image-load telemetry (ImageLoaded) and filters out known benign locations for the matched DLLs using hardcoded program path prefixes and specific executable context where applicable.
references:
  - https://hijacklibs.net/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_antivirus.yml
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research), Huntrule Team
date: 2022-08-17
modified: 2025-10-07
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection_bitdefender:
    ImageLoaded|endswith: \log.dll
  filter_log_dll_bitdefender:
    ImageLoaded|startswith:
      - C:\Program Files\Bitdefender Antivirus Free\
      - C:\Program Files (x86)\Bitdefender Antivirus Free\
  filter_log_dll_dell_sar:
    Image: C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe
    ImageLoaded:
      - C:\Program Files\Dell\SARemediation\plugin\log.dll
      - C:\Program Files\Dell\SARemediation\audit\log.dll
  filter_log_dll_canon:
    ImageLoaded|startswith: C:\Program Files\Canon\MyPrinter\
  filter_log_dll_avast:
    ImageLoaded:
      - C:\Program Files\AVAST Software\Avast\log.dll
      - C:\Program Files (x86)\AVAST Software\Avast\log.dll
  filter_log_dll_avg:
    ImageLoaded:
      - C:\Program Files\AVG\Antivirus\log.dll
      - C:\Program Files (x86)\AVG\Antivirus\log.dll
  selection_fsecure:
    ImageLoaded|endswith: \qrt.dll
  filter_fsecure:
    ImageLoaded|startswith:
      - C:\Program Files\F-Secure\Anti-Virus\
      - C:\Program Files (x86)\F-Secure\Anti-Virus\
  selection_mcafee:
    ImageLoaded|endswith:
      - \ashldres.dll
      - \lockdown.dll
      - \vsodscpl.dll
  filter_mcafee:
    ImageLoaded|startswith:
      - C:\Program Files\McAfee\
      - C:\Program Files (x86)\McAfee\
  selection_cyberark:
    ImageLoaded|endswith: \vftrace.dll
  filter_cyberark:
    ImageLoaded|startswith:
      - C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\
      - C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32\
  selection_avast:
    ImageLoaded|endswith: \wsc.dll
  filter_wsc_dll_avast:
    ImageLoaded|startswith:
      - C:\program Files\AVAST Software\Avast\
      - C:\program Files (x86)\AVAST Software\Avast\
  filter_wsc_dll_avg:
    ImageLoaded|startswith:
      - C:\Program Files\AVG\Antivirus\
      - C:\Program Files (x86)\AVG\Antivirus\
  selection_eset_deslock:
    ImageLoaded|endswith: \DLPPREM32.dll
  filter_eset_deslock:
    ImageLoaded|startswith:
      - C:\program Files\ESET
      - C:\program Files (x86)\ESET
  selection_titanium:
    ImageLoaded|endswith: \tmdbglog.dll
  filter_titanium:
    ImageLoaded|startswith:
      - C:\program Files\Trend Micro\Titanium\
      - C:\program Files (x86)\Trend Micro\Titanium\
  condition: (selection_bitdefender and not 1 of filter_log_dll_*) or (selection_fsecure and not filter_fsecure) or (selection_mcafee and not filter_mcafee) or (selection_cyberark and not filter_cyberark) or (selection_avast and not 1 of filter_wsc_dll_*) or (selection_titanium and not filter_titanium) or (selection_eset_deslock and not filter_eset_deslock)
falsepositives:
  - Applications that load the same dlls mentioned in the detection section. Investigate them and filter them out if a lot FPs are caused.
  - Dell SARemediation plugin folder (C:\Program Files\Dell\SARemediation\plugin\log.dll) is known to contain the 'log.dll' file.
  - The Canon MyPrinter folder 'C:\Program Files\Canon\MyPrinter\' is known to contain the 'log.dll' file
level: medium
license: DRL-1.1
related:
  - id: 552b6b65-df37-4d3e-a258-f2fc4771ae54
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL