Windows RoboForm DLL Sideloading via ImageLoaded roboform.dll/roboform-x64.dll

Alerts on loaded roboform*.dll modules on Windows when module loading is not matched to expected RoboForm binaries.

FreeReviewedSigma · Medium · v2

Product: windows
Category: image_load
Author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-05-14
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1574.001DLL
Defense Evasion
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows image-load events where roboform.dll or roboform-x64.dll is loaded, which can indicate DLL sideloading or related execution manipulation around RoboForm components. Attackers may abuse search-order or side-loading behavior to load a malicious DLL from an unexpected location. The detection relies on image-load telemetry (ImageLoaded) and correlates it with the loaded module and specific parent executable names while excluding known main-path patterns.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)

Suspicious Cortex XDR Binary Sideloading winutils.dll (via image_load)

Suspicious CoinLoader DLL Sideload From Z-1-36-81 Directory (via image_load)

Suspicious shfolder.dll Sideloading via VMware net-service Binary

Windows RoboForm DLL Sideloading via ImageLoaded roboform.dll/roboform-x64.dll

Pivot detection · T1574.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-potential-roboform-dll-sideloading-via-image-load-of-roboform-dll-f64c9b2d

title: Windows RoboForm DLL Sideloading via ImageLoaded roboform.dll/roboform-x64.dll
id: 7846ccb1-3d23-4808-8579-bcdfef6c555c
status: test
description: This rule flags Windows image-load events where roboform.dll or roboform-x64.dll is loaded, which can indicate DLL sideloading or related execution manipulation around RoboForm components. Attackers may abuse search-order or side-loading behavior to load a malicious DLL from an unexpected location. The detection relies on image-load telemetry (ImageLoaded) and correlates it with the loaded module and specific parent executable names while excluding known main-path patterns.
references:
  - https://twitter.com/StopMalvertisin/status/1648604148848549888
  - https://twitter.com/t3ft3lb/status/1656194831830401024
  - https://www.roboform.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_robform.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-14
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - \roboform.dll
      - \roboform-x64.dll
  filter_main_path:
    Image|startswith:
      - " C:\\Program Files (x86)\\Siber Systems\\AI RoboForm\\"
      - " C:\\Program Files\\Siber Systems\\AI RoboForm\\"
    Image|endswith:
      - \robotaskbaricon.exe
      - \robotaskbaricon-x64.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - If installed on a per-user level, the path would be located in "AppData\Local". Add additional filters to reflect this mode of installation
level: medium
license: DRL-1.1
related:
  - id: f64c9b2d-b0ad-481d-9d03-7fc75020892a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL