Windows Image Load Trusted-Path Bypass via Spoofed System Directory with Extra Space

Flags Windows DLL loads from spoofed "C:\Windows \\System32"-style paths with an extra space to indicate trusted-path bypass attempts.

FreeUnreviewedSigmahighv1

windows-image-load-trusted-path-bypass-via-spoofed-system-directory-with-extra-s-0cbe38c0

title: Windows Image Load Trusted-Path Bypass via Spoofed System Directory with Extra Space
id: 37be217d-81d1-49c7-b0d0-662edf057034
related:
  - id: 4ac47ed3-44c2-4b1f-9d51-bf46e8914126
    type: similar
  - id: 0cbe38c0-270c-41d9-ab79-6e5a9a669290
    type: derived
status: experimental
description: This rule identifies Windows DLL image loads from paths that include an extra space inside the Windows system directory (for example, "C:\Windows \System32\" or "C:\Windows \SysWOW64\"). Such spoofed paths may be treated as trusted, enabling malicious DLLs to load from a location associated with high-integrity behavior. It relies on image load telemetry showing the full ImageLoaded string containing the specific spoofed directory patterns.
references:
  - https://x.com/Wietze/status/1933495426952421843
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_win_trusted_path_bypass.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-17
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.007
  - attack.t1548.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|contains:
      - :\Windows \System32\
      - :\Windows \SysWOW64\
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule identifies Windows DLL image loads from paths that include an extra space inside the Windows system directory (for example, "C:\Windows \System32\" or "C:\Windows \SysWOW64\"). Such spoofed paths may be treated as trusted, enabling malicious DLLs to load from a location associated with high-integrity behavior. It relies on image load telemetry showing the full ImageLoaded string containing the specific spoofed directory patterns.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.