Windows: Potential DLL Sideloading via MpSvc.DLL Loads

Flags Windows module loads of MpSvc.dll outside typical Defender/WinSxS locations that may indicate DLL sideloading.

FreeUnreviewedSigmamediumv1

windows-potential-dll-sideloading-via-mpsvc-dll-loads-5ba243e5

title: "Windows: Potential DLL Sideloading via MpSvc.DLL Loads"
id: ee2fd15f-f91b-47b3-97e0-660a3ad22205
status: test
description: This rule flags Windows processes that load an ImageLoaded path ending with "\MpSvc.dll" while excluding common legitimate Defender and WinSxS locations. DLL sideloading matters because attackers can place a malicious DLL alongside or in place of an expected binary to execute unintended code. The detection relies on image-load telemetry that records the full loaded module path, using suffix matching for the DLL name and prefix-based filtering to reduce benign matches.
references:
  - https://hijacklibs.net/entries/microsoft/built-in/mpsvc.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_mpsvc.yml
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema, Huntrule Team
date: 2024-07-11
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    ImageLoaded|endswith: \MpSvc.dll
  filter_main_generic:
    ImageLoaded|startswith:
      - C:\Program Files\Windows Defender\
      - C:\ProgramData\Microsoft\Windows Defender\Platform\
      - C:\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate applications loading their own versions of the DLL mentioned in this rule.
level: medium
license: DRL-1.1
related:
  - id: 5ba243e5-8165-4cf7-8c69-e1d3669654c1
    type: derived

What it detects

This rule flags Windows processes that load an ImageLoaded path ending with "\MpSvc.dll" while excluding common legitimate Defender and WinSxS locations. DLL sideloading matters because attackers can place a malicious DLL alongside or in place of an expected binary to execute unintended code. The detection relies on image-load telemetry that records the full loaded module path, using suffix matching for the DLL name and prefix-based filtering to reduce benign matches.

Known false positives

Legitimate applications loading their own versions of the DLL mentioned in this rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.