Windows DLL Sideloading via Abusable DLLs Loaded from Suspicious Locations
Flags Windows module loads of specific abusable DLL names from public, temp, or user folders consistent with potential DLL sideloading.
- Product
- windows
- Category
- image_load
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-11
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows image loads of specific abusable DLLs when they are loaded from paths commonly associated with user-writable or transient locations. Attackers may leverage DLL search order or side-loading to execute attacker-controlled code under a legitimate process. The detection relies on image_load telemetry that records the loaded module path, matching both the DLL name suffixes and suspicious directory substrings.
Reporting behind it
- trendmicro.comhttps://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html
- research.checkpoint.comhttps://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_abused_dlls_susp_paths.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DLL Sideloading via Abusable DLLs Loaded from Suspicious Locations
id: e52d2111-c581-4a33-8517-245c77722253
status: test
description: This rule flags Windows image loads of specific abusable DLLs when they are loaded from paths commonly associated with user-writable or transient locations. Attackers may leverage DLL search order or side-loading to execute attacker-controlled code under a legitimate process. The detection relies on image_load telemetry that records the loaded module path, matching both the DLL name suffixes and suspicious directory substrings.
references:
- https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html
- https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_abused_dlls_susp_paths.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-11
tags:
- attack.execution
- attack.t1059
logsource:
category: image_load
product: windows
detection:
selection_dll:
ImageLoaded|endswith:
- \coreclr.dll
- \facesdk.dll
- \HPCustPartUI.dll
- \libcef.dll
- \ZIPDLL.dll
selection_folders_1:
ImageLoaded|contains:
- :\Perflogs\
- :\Users\Public\
- \Temporary Internet
- \Windows\Temp\
selection_folders_2:
- ImageLoaded|contains|all:
- :\Users\
- \Favorites\
- ImageLoaded|contains|all:
- :\Users\
- \Favourites\
- ImageLoaded|contains|all:
- :\Users\
- \Contacts\
- ImageLoaded|contains|all:
- :\Users\
- \Pictures\
condition: selection_dll and 1 of selection_folders_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 799a5f48-0ac1-4e0f-9152-71d137d48c2a
type: derived