Windows ImageLoad DLL Sideloading: EACore.dll
Alerts on Windows loading of EACore.dll that may indicate DLL sideloading, excluding a specific EA Desktop legitimate case.
- Product
- windows
- Category
- image_load
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-03
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process image-load events where the loaded module name ends with EACore.dll. It treats EACore.dll loads as suspicious unless the image path and EACoreServer.exe context match the expected Electronic Arts EA Desktop location. Attackers may use DLL sideloading to execute malicious code under a legitimate process, so the rule relies on Windows image load telemetry capturing both ImageLoaded and the loading process Image path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows ImageLoad DLL Sideloading: EACore.dll"
id: 552a14c0-f4d6-4676-b92f-9f9db8109733
status: test
description: This rule flags process image-load events where the loaded module name ends with EACore.dll. It treats EACore.dll loads as suspicious unless the image path and EACoreServer.exe context match the expected Electronic Arts EA Desktop location. Attackers may use DLL sideloading to execute malicious code under a legitimate process, so the rule relies on Windows image load telemetry capturing both ImageLoaded and the loading process Image path.
references:
- https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_eacore.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-08-03
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: \EACore.dll
filter_main_legit_path:
Image|contains|all:
- C:\Program Files\Electronic Arts\EA Desktop\
- \EACoreServer.exe
ImageLoaded|startswith: C:\Program Files\Electronic Arts\EA Desktop\
condition: selection and not 1 of filter_main_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5
type: derived