Sigma detection rules, expert-reviewed

Malicious HUI Loader DLL Side-Loading via McAfee mfeann.exe (via image_load)

This rule detects HUI Loader side-loading, where the legitimate signed McAfee binary mfeann.exe loads an attacker-supplied LockDown.dll. This pairing was used against the Asian gambling sector to run encrypted payloads under a trusted process. The DLL name loaded by this specific host executable is a strong side-loading indicator.

Possible python311 DLL Side-Loading by Non Python Host Process

This rule detects a process that is not a Python interpreter loading python311.dll which can indicate DLL side-loading. Silver Fox side-loads a malicious python311.dll alongside a decoy executable to run ValleyRAT shellcode. Because many legitimate applications embed Python this pattern requires context before it can be confirmed as malicious.

Malicious DLL Side-Loading via Renamed BluetoothService.exe Loading log.dll (via image_load)

This rule detects a process named BluetoothService.exe loading log.dll, the DLL side-loading chain from the Notepad++ supply-chain compromise where a renamed signed Bitdefender binary loads the malicious log.dll. Running the Chrysalis payload under a trusted signed loader evades defenses and hides the implant.

Malicious Gh0st RAT DLL Side-Loading via wsc_proxy Loading wsc.dll (via image_load)

This rule detects the signed helper wsc_proxy.exe loading a wsc.dll module, the DLL side-loading chain abused by impersonation campaigns distributing Gh0st RAT. Adversaries drop a malicious wsc.dll beside the trusted loader so the payload runs under a benign process, evading endpoint defenses and establishing covert execution.

Malicious DLL Side-Loading via 7z or clink Loaders

This rule detects the 7z or clink binaries side-loading their companion DLLs from non-standard locations. Project AK47 abuses 7z.exe with a malicious 7z.dll and clink_x86.exe with clink_dll_x86.dll to execute payloads under trusted binaries. Loading these DLLs outside their normal install directories indicates search-order hijacking.

Suspicious mscorsvw Side-Loading mscorsvc DLL from Assembly Path

This rule detects mscorsvw.exe loading mscorsvc.dll from the Windows assembly directory. The covert C2 backdoor plants a malicious mscorsvc.dll in this path so the trusted .NET optimizer side-loads it. This DLL hijack lets the attacker execute code under a signed Microsoft process.

Malicious DLL Side-Loading via DingTalk Loading zlibwapi

This rule detects the legitimate DingTalk.exe binary loading a zlibwapi.dll from outside standard install paths. In the SLOW#TEMPEST intrusion attackers abuse DingTalk to side-load a malicious zlibwapi.dll that carries the ipc_core.dll payload. Trusted signed binary loading an unsigned helper DLL from an unexpected directory is a classic DLL search-order hijack.

Suspicious CANONSTAGER DLL Side-Loading via cnmpaui Executable

This rule detects the legitimate Canon utility cnmpaui.exe loading a DLL from a user-writable directory outside its normal Program Files location, matching the PRC-Nexus CANONSTAGER side-loading that launches the SOGU.SEC backdoor. Abusing a signed printer binary lets the actor execute malicious code under a trusted process during espionage against diplomats.

Malicious DLL Side-Loading of Avk.dll by G DATA Binary via PlugX (via image_load)

This rule detects the G DATA Avk.exe binary loading an Avk.dll from the Users Public GDatas directory, the side-loading step that decrypts and injects the PlugX payload. Genuine G DATA installations load their DLLs from the protected Program Files location.

Malicious DLL Side-Loading via Remote Desktop Binaries for DreamLoaders (via image_load)

This rule detects the wksprt.exe or wkspbroker.exe Remote Desktop binaries loading webservices.dll or radcui.dll from outside the Windows system directories, the side-loading step used by the Lazarus DreamLoaders. These signed binaries normally load such DLLs only from System32 or WinSxS.

Malicious DLL Side-Loading of appvisvsubsystems64.dll via Cobalt Strike Loader (via image_load)

This rule detects the AppV appvisvsubsystems64.dll being loaded from the ProgramData directory by a renamed Word binary, the side-loading step that launches a Cobalt Strike beacon. The genuine appvisvsubsystems64.dll ships only inside System32.

Suspicious DLL Side-Loading Host Binary Executed Outside System32 by Lazarus

This rule detects execution of signed host binaries such as CameraSettingsUIHost.exe or Dxpserver.exe from directories outside the Windows System32 path. The Lazarus group side-loads malicious DLLs (DUI70.dll, dwmapi.dll) by placing these legitimate executables in attacker-controlled folders. A trusted binary running from an unexpected location indicates a DLL search-order hijack.

Suspicious libEGL.dll Side-Loading from Public Libraries Directory (via image_load)

This rule detects a load of libEGL.dll from the C:\Users\Public\Libraries directory. The Ducktail toolset places a malicious libEGL.dll in Public\Libraries to be side-loaded by a signed host binary, so a load of this graphics-named DLL from a world-writable staging path indicates DLL side-loading rather than legitimate rendering support.

Suspicious Side-Loading of wbemcomn.dll or ESENT.dll from Non-System Path (via image_load)

This rule detects a load of wbemcomn.dll or ESENT.dll from a directory outside the standard Windows system folders. Lazarus deploys its LPEClient downloader as a rogue wbemcomn.dll or ESENT.dll that is side-loaded by a signed host process, so a system-named DLL loading from an unexpected path signals DLL search-order hijacking used to stage further payloads.

Malicious DLL Side-Loading by 3CX Desktop Application (via image_load)

This rule detects the 3CX desktop application loading ffmpeg.dll or d3dcompiler_47.dll from its own directory, the side-loading chain used in the supply chain compromise. The trojanized ffmpeg first stage and d3dcompiler decryptor run under the trusted signed 3CX process to stage second-stage shellcode.