Windows: Potential DLL Sideloading via Loading msocrsvc.dll

Alerts on non-standard loads of msocrsvc.dll, a potential DLL sideloading opportunity on Windows.

FreeUnreviewedSigmamediumv1

windows-potential-dll-sideloading-via-loading-msocrsvc-dll-cdb15e19

title: "Windows: Potential DLL Sideloading via Loading msocrsvc.dll"
id: a21ac530-1626-4687-95bc-3612fb45a000
status: test
description: This rule flags Windows image load events where a DLL named msocrsvc.dll is loaded from a non-standard path. Attackers can use DLL sideloading to execute malicious code by influencing what module is loaded at runtime. The detection relies on process image load telemetry indicating the loaded DLL filename and its full path, and it suppresses loads from common Microsoft .NET and WinSxS directories.
references:
  - https://hijacklibs.net/entries/microsoft/built-in/mscorsvc.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_mscorsvc.yml
author: Wietze Beukema, Huntrule Team
date: 2024-07-11
modified: 2025-02-26
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    ImageLoaded|endswith: \mscorsvc.dll
  filter_main_generic:
    ImageLoaded|startswith:
      - C:\Windows\Microsoft.NET\Framework\
      - C:\Windows\Microsoft.NET\Framework64\
      - C:\Windows\Microsoft.NET\FrameworkArm\
      - C:\Windows\Microsoft.NET\FrameworkArm64\
      - C:\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate applications loading their own versions of the DLL mentioned in this rule.
level: medium
license: DRL-1.1
related:
  - id: cdb15e19-c2d0-432a-928e-e49c8c60dcf2
    type: derived

What it detects

This rule flags Windows image load events where a DLL named msocrsvc.dll is loaded from a non-standard path. Attackers can use DLL sideloading to execute malicious code by influencing what module is loaded at runtime. The detection relies on process image load telemetry indicating the loaded DLL filename and its full path, and it suppresses loads from common Microsoft .NET and WinSxS directories.

Known false positives

Legitimate applications loading their own versions of the DLL mentioned in this rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.