Windows Security Mitigations: Blocked Unsigned DLLs Loaded from Suspicious Paths

title: "Windows Security Mitigations: Blocked Unsigned DLLs Loaded from Suspicious Paths"
id: 35d60523-6dad-402d-81df-fefde5a75819
status: test
description: This rule flags Windows Security Mitigations events where a process loading an unsigned DLL is blocked. The matched paths include commonly abused locations such as public user folders, downloads, desktop, and temporary directories, which attackers may use to stage malicious code. It relies on Security Mitigations telemetry (event IDs 11 and 12) that record blocked loads related to code integrity checks.
references:
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/45fd5be71a51aa518b1b36d4e1f36af498084e27/ETWEventsList/CSV/Windows11/21H2/W11_21H2_Pro_20220719_22000.795/Providers/Microsoft-Windows-Security-Mitigations.csv
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security_mitigations/win_security_mitigations_unsigned_dll_from_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-03
modified: 2022-09-28
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  service: security-mitigations
detection:
  selection:
    EventID:
      - 11
      - 12
    ImageName|contains:
      - \Users\Public\
      - \PerfLogs\
      - \Desktop\
      - \Downloads\
      - \AppData\Local\Temp\
      - C:\Windows\TEMP\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8289bf8c-4aca-4f5a-9db3-dc3d7afe5c10
    type: derived