Windows Office Apps Loading .NET GAC MSIL DLLs via Image Load Events

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags image load events where a Microsoft Office executable (Excel, PowerPoint, Outlook, Word, or OneNote) loads a DLL from the .NET Global Assembly Cache (GAC) MSIL path. Loading from the GAC can be used by attackers to execute or proxy .NET components during Office-driven activity, making this a useful execution-chain indicator. It relies on Windows image load telemetry capturing the loading process path and the loaded module path.

Reporting behind it

Related detections9 linkedT1204.002 — drag to rearrange

Suspicious OneNote Spawning Script Interpreter (via process_creation)

Suspicious vbc.exe Spawned by Installer Process

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

Suspicious NFe-Themed Brazilian Lure Executable Execution

Suspicious Executable Dropped in Public Users Directory Named Ctrlpanel (via file_event)

Suspicious Interlock Fake Updater Executable Execution

Malicious Office Application Loading a User-Path DLL via Regsvr32 or Rundll32 (via process_creation)

Suspicious Program Execution From a Mounted ISO or Disk Image (via process_creation)

SocGholish Fake Browser Update Script Execution (via process_creation)

Windows Office Apps Loading .NET GAC MSIL DLLs via Image Load Events

Pivot detection · T1204.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-office-apps-loading-gac-net-dlls-via-image-load-events-90217a70

title: Windows Office Apps Loading .NET GAC MSIL DLLs via Image Load Events
id: d406c424-a5e4-4ff7-bc4c-0672111b1a5c
status: test
description: This rule flags image load events where a Microsoft Office executable (Excel, PowerPoint, Outlook, Word, or OneNote) loads a DLL from the .NET Global Assembly Cache (GAC) MSIL path. Loading from the GAC can be used by attackers to execute or proxy .NET components during Office-driven activity, making this a useful execution-chain indicator. It relies on Windows image load telemetry capturing the loading process path and the loaded module path.
references:
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_office_dotnet_gac_dll_load.yml
author: Antonlovesdnb, Huntrule Team
date: 2020-02-19
modified: 2023-02-10
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - \excel.exe
      - \mspub.exe
      - \onenote.exe
      - \onenoteim.exe
      - \outlook.exe
      - \powerpnt.exe
      - \winword.exe
    ImageLoaded|startswith: C:\Windows\Microsoft.NET\assembly\GAC_MSIL
  condition: selection
falsepositives:
  - Legitimate macro usage. Add the appropriate filter according to your environment
level: high
license: DRL-1.1
related:
  - id: 90217a70-13fc-48e4-b3db-0d836c5824ac
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL