Windows Utility Loads Unsigned DLL (ImageLoad)
Flags DLL loads by InstallUtil/RegAsm/RegSvcs/regsvr32/rundll32 when the loaded DLL is unsigned or untrusted.
- Product
- windows
- Category
- image_load
- Author
- Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
- Published
- 2024-02-28
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows utility processes that load DLL files which are not signed as trusted/valid, based on Signature and SignatureStatus fields for the loaded module. Attackers can abuse legitimate DLL-loading utilities to run or proxy malicious code while blending in with normal Windows behavior. Telemetry required includes process image name and the loaded DLL path/classification from Windows ImageLoad events, along with signature validation attributes.
Reporting behind it
- elastic.cohttps://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion
- akhere.hashnode.devhttps://akhere.hashnode.dev/hunting-unsigned-dlls-using-kql
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unsigned-dlls/?web_view=true
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_susp_unsigned_dll.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Utility Loads Unsigned DLL (ImageLoad)
id: 04a79c4a-5835-40c5-8fe2-e205d49e1e59
status: test
description: This rule flags Windows utility processes that load DLL files which are not signed as trusted/valid, based on Signature and SignatureStatus fields for the loaded module. Attackers can abuse legitimate DLL-loading utilities to run or proxy malicious code while blending in with normal Windows behavior. Telemetry required includes process image name and the loaded DLL path/classification from Windows ImageLoad events, along with signature validation attributes.
references:
- https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion
- https://akhere.hashnode.dev/hunting-unsigned-dlls-using-kql
- https://unit42.paloaltonetworks.com/unsigned-dlls/?web_view=true
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_susp_unsigned_dll.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-02-28
modified: 2025-10-07
tags:
- attack.stealth
- attack.t1218.011
- attack.t1218.010
logsource:
product: windows
category: image_load
detection:
selection:
Image|endswith:
- \InstallUtil.exe
- \RegAsm.exe
- \RegSvcs.exe
- \regsvr32.exe
- \rundll32.exe
filter_main_signed:
Signed: "true"
filter_main_sig_status:
SignatureStatus:
- errorChaining
- errorCode_endpoint
- errorExpired
- trusted
- Valid
filter_main_signed_null:
Signed: null
filter_main_signed_empty:
Signed:
- ""
- "-"
filter_main_sig_status_null:
SignatureStatus: null
filter_main_sig_status_empty:
SignatureStatus:
- ""
- "-"
filter_main_windows_installer:
Image:
- C:\Windows\SysWOW64\rundll32.exe
- C:\Windows\System32\rundll32.exe
ImageLoaded|startswith: C:\Windows\Installer\
ImageLoaded|endswith:
- .tmp-\Microsoft.Deployment.WindowsInstaller.dll
- .tmp-\Avira.OE.Setup.CustomActions.dll
filter_main_assembly:
Image|startswith:
- C:\Windows\SysWOW64\
- C:\Windows\System32\
- C:\Windows\Microsoft.NET\Framework64
Image|endswith: \RegAsm.exe
ImageLoaded|endswith: .dll
ImageLoaded|startswith: C:\Windows\assembly\NativeImages
filter_optional_klite_codec:
Image:
- C:\Windows\SysWOW64\regsvr32.exe
- C:\Windows\System32\regsvr32.exe
ImageLoaded|startswith:
- C:\Program Files (x86)\K-Lite Codec Pack\
- C:\Program Files\K-Lite Codec Pack\
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: b5de0c9a-6f19-43e0-af4e-55ad01f550af
type: derived