huntrule

Windows: Detect ImageLoad of vivaldi_elf.dll for Potential DLL Sideloading

Flags ImageLoad events for vivaldi_elf.dll on Windows that are not consistent with an expected Vivaldi app path.

FreeReviewedSigma · Medium · v2
Product
windows
Category
image_load
Author
X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-08-03
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags when the Windows image loader loads a DLL named vivaldi_elf.dll. DLL sideloading is commonly used to execute attacker-controlled code under the context of a legitimate process, so anomalous loads of this specific DLL matter. It relies on image load telemetry that provides the loading process path (Image) and the DLL load path (ImageLoaded), and excludes cases where the DLL load occurs from an expected Vivaldi application directory for the main Vivaldi executable.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange
Malicious DLL Sideloading via consent.exe Loading msimg32.dll (via image_load)
Malicious Bumblebee DLL Sideload of msimg32 by consent from Non-System Path (via image_load)
Suspicious BugSplat Binary Sideloading bugsplatrc.dll via DLL Search Order Hijack
Suspicious SentinelOne Binary Sideloading sentinelagentcore.dll
Suspicious 7-Zip Executable Sideloading 7z.dll Loader
Suspicious Loading of Masqueraded EndpointDlp.dll Backdoor
Suspicious Trend Micro Binary Sideloading tmdglog.dll
Suspicious DLL Sideloading via ProtonVPN Executable (via image_load)
Suspicious DLL Sideloading via OneDriveStandaloneUpdater (via image_load)
Windows: Detect ImageLoad of vivaldi_elf.dll for Potential DLL Sideloading
Pivot detection · T1574.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.