Windows ImageLoad Abusable DLLs from Suspicious Paths Potential Sideloading

Flags Windows module loads of specific abusable DLL names from public, temp, or user folders consistent with potential DLL sideloading.

FreeUnreviewedSigmahighv1

windows-imageload-abusable-dlls-from-suspicious-paths-potential-sideloading-799a5f48

title: Windows ImageLoad Abusable DLLs from Suspicious Paths Potential Sideloading
id: e52d2111-c581-4a33-8517-245c77722253
status: test
description: Identifies Windows processes loading specific DLL filenames associated with known abuse when the DLL path is located in suspicious user-writable or temporary locations. This behavior can indicate DLL search order or sideloading tactics used to execute attacker-controlled code under a legitimate process. The rule relies on image load telemetry that records the loaded module name and its full path for the process.
references:
  - https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html
  - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_abused_dlls_susp_paths.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-11
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: image_load
  product: windows
detection:
  selection_dll:
    ImageLoaded|endswith:
      - \coreclr.dll
      - \facesdk.dll
      - \HPCustPartUI.dll
      - \libcef.dll
      - \ZIPDLL.dll
  selection_folders_1:
    ImageLoaded|contains:
      - :\Perflogs\
      - :\Users\Public\
      - \Temporary Internet
      - \Windows\Temp\
  selection_folders_2:
    - ImageLoaded|contains|all:
        - :\Users\
        - \Favorites\
    - ImageLoaded|contains|all:
        - :\Users\
        - \Favourites\
    - ImageLoaded|contains|all:
        - :\Users\
        - \Contacts\
    - ImageLoaded|contains|all:
        - :\Users\
        - \Pictures\
  condition: selection_dll and 1 of selection_folders_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 799a5f48-0ac1-4e0f-9152-71d137d48c2a
    type: derived

What it detects

Identifies Windows processes loading specific DLL filenames associated with known abuse when the DLL path is located in suspicious user-writable or temporary locations. This behavior can indicate DLL search order or sideloading tactics used to execute attacker-controlled code under a legitimate process. The rule relies on image load telemetry that records the loaded module name and its full path for the process.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.