huntrule

Windows Utility Loads Unsigned DLL (ImageLoad)

Flags DLL loads by InstallUtil/RegAsm/RegSvcs/regsvr32/rundll32 when the loaded DLL is unsigned or untrusted.

FreeReviewedSigma · Medium · v2
Product
windows
Category
image_load
Author
Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
Published
2024-02-28
Updated
2026-07-31
AnalysisDetection
title: Windows Utility Loads Unsigned DLL (ImageLoad)
id: 04a79c4a-5835-40c5-8fe2-e205d49e1e59
status: test
description: This rule flags Windows utility processes that load DLL files which are not signed as trusted/valid, based on Signature and SignatureStatus fields for the loaded module. Attackers can abuse legitimate DLL-loading utilities to run or proxy malicious code while blending in with normal Windows behavior. Telemetry required includes process image name and the loaded DLL path/classification from Windows ImageLoad events, along with signature validation attributes.
references:
  - https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion
  - https://akhere.hashnode.dev/hunting-unsigned-dlls-using-kql
  - https://unit42.paloaltonetworks.com/unsigned-dlls/?web_view=true
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_susp_unsigned_dll.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-02-28
modified: 2025-10-07
tags:
  - attack.stealth
  - attack.t1218.011
  - attack.t1218.010
logsource:
  product: windows
  category: image_load
detection:
  selection:
    Image|endswith:
      - \InstallUtil.exe
      - \RegAsm.exe
      - \RegSvcs.exe
      - \regsvr32.exe
      - \rundll32.exe
  filter_main_signed:
    Signed: "true"
  filter_main_sig_status:
    SignatureStatus:
      - errorChaining
      - errorCode_endpoint
      - errorExpired
      - trusted
      - Valid
  filter_main_signed_null:
    Signed: null
  filter_main_signed_empty:
    Signed:
      - ""
      - "-"
  filter_main_sig_status_null:
    SignatureStatus: null
  filter_main_sig_status_empty:
    SignatureStatus:
      - ""
      - "-"
  filter_main_windows_installer:
    Image:
      - C:\Windows\SysWOW64\rundll32.exe
      - C:\Windows\System32\rundll32.exe
    ImageLoaded|startswith: C:\Windows\Installer\
    ImageLoaded|endswith:
      - .tmp-\Microsoft.Deployment.WindowsInstaller.dll
      - .tmp-\Avira.OE.Setup.CustomActions.dll
  filter_main_assembly:
    Image|startswith:
      - C:\Windows\SysWOW64\
      - C:\Windows\System32\
      - C:\Windows\Microsoft.NET\Framework64
    Image|endswith: \RegAsm.exe
    ImageLoaded|endswith: .dll
    ImageLoaded|startswith: C:\Windows\assembly\NativeImages
  filter_optional_klite_codec:
    Image:
      - C:\Windows\SysWOW64\regsvr32.exe
      - C:\Windows\System32\regsvr32.exe
    ImageLoaded|startswith:
      - C:\Program Files (x86)\K-Lite Codec Pack\
      - C:\Program Files\K-Lite Codec Pack\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: b5de0c9a-6f19-43e0-af4e-55ad01f550af
    type: derived