Windows Office Apps Loading .NET GAC MSIL DLLs via Image Load Events

Alerts when an Office app loads a .NET DLL from the GAC_MSIL directory.

FreeReviewedSigma · High · v2

Product: windows
Category: image_load
Author: Antonlovesdnb (SigmaHQ), DRL 1.1
Published: 2020-02-19
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags image load events where a Microsoft Office executable (Excel, PowerPoint, Outlook, Word, or OneNote) loads a DLL from the .NET Global Assembly Cache (GAC) MSIL path. Loading from the GAC can be used by attackers to execute or proxy .NET components during Office-driven activity, making this a useful execution-chain indicator. It relies on Windows image load telemetry capturing the loading process path and the loaded module path.

Reporting behind it

Related detections9 linkedT1204.002 — drag to rearrange

Malicious Lunar Spider Loader Execution via rundll32 (via process_creation)

Suspicious HijackLoader Component Execution via ClearFake

Malicious Silent AteraAgent RMM Installation via IntegratorLogin

Suspicious Windows Script Host Execution of JavaScript from Temporary Archive Extraction Folder (via process_creation)

Suspicious PowerShell Launched by MSIX StartingScriptWrapper From WindowsApps via Process Creation (via process_creation)

Suspicious PowerShell Remote TXT Payload Download Spawned by Shortcut via LNK (via process_creation)

Suspicious Script Interpreter Spawned by OneNote via Embedded Attachment (via process_creation)

Suspicious ClickFix Command Execution via RunMRU Registry Key

Suspicious Base64 Bash Execution via nohup on macOS via ClickFix (via process_creation)

Windows Office Apps Loading .NET GAC MSIL DLLs via Image Load Events

Pivot detection · T1204.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-office-apps-loading-gac-net-dlls-via-image-load-events-90217a70

title: Windows Office Apps Loading .NET GAC MSIL DLLs via Image Load Events
id: d406c424-a5e4-4ff7-bc4c-0672111b1a5c
status: test
description: This rule flags image load events where a Microsoft Office executable (Excel, PowerPoint, Outlook, Word, or OneNote) loads a DLL from the .NET Global Assembly Cache (GAC) MSIL path. Loading from the GAC can be used by attackers to execute or proxy .NET components during Office-driven activity, making this a useful execution-chain indicator. It relies on Windows image load telemetry capturing the loading process path and the loaded module path.
references:
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_office_dotnet_gac_dll_load.yml
author: Antonlovesdnb, Huntrule Team
date: 2020-02-19
modified: 2023-02-10
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - \excel.exe
      - \mspub.exe
      - \onenote.exe
      - \onenoteim.exe
      - \outlook.exe
      - \powerpnt.exe
      - \winword.exe
    ImageLoaded|startswith: C:\Windows\Microsoft.NET\assembly\GAC_MSIL
  condition: selection
falsepositives:
  - Legitimate macro usage. Add the appropriate filter according to your environment
level: high
license: DRL-1.1
related:
  - id: 90217a70-13fc-48e4-b3db-0d836c5824ac
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL