Windows System Process Loads DLL from Suspicious or Permissive Path

title: Windows System Process Loads DLL from Suspicious or Permissive Path
id: 0ab34594-dbf3-44d9-a6da-b392639bf5cc
status: test
description: This rule flags events where a Windows system process loads a DLL from a path commonly associated with suspicious or permissive access locations. Attackers often use such locations to execute or hijack code by forcing trusted processes to load malicious libraries. The detection relies on image load telemetry indicating the loading process path and the DLL’s loaded path prefixes, including C:\Users\Public\ and C:\PerfLogs\.
references:
  - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC (Idea)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_susp_dll_load_system_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-17
modified: 2023-09-18
tags:
  - attack.stealth
  - attack.t1070
logsource:
  product: windows
  category: image_load
detection:
  selection:
    Image|startswith: C:\Windows\
    ImageLoaded|startswith:
      - C:\Users\Public\
      - C:\PerfLogs\
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c
    type: derived