Sigma detection rules, expert-reviewed

DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL

This rule detects trusted signed executables side-loading helper DLLs commonly abused for DLL search-order hijacking such as GUP.exe loading libcurl.dll or MsMpEng.exe loading mpsvc.dll. This technique was widely abused by PlugX and related tooling to run malicious code under the guise of a legitimate signed process, and the rule filters the legitimate Windows Defender load path.

Malicious DLL Side-Loading of vcomp100 via converter.exe

This rule detects the ImageMagick converter.exe loading vcomp100.dll from outside the Windows system directories. The IDAT loader chain delivering Vidar and ACR stealers abused this signed binary to side-load a malicious vcomp100.dll and execute stager code under a trusted process.

DLL Side-Loading of NvSmartMax via NvSmart Host Process

This rule detects the nvSmartEx.exe host loading NvSmartMax.dll from outside the legitimate NVIDIA program directory, the DLL side-loading pair used by DeadRinger actors to run implant code. A trusted NVIDIA binary loading its companion DLL from an unexpected path indicates search-order hijacking.

Suspicious DLL Side-Loading of wbemcomn From Non-System Path

This rule detects loading of wbemcomn.dll from a directory outside the Windows system folders, indicating DLL side-loading. In CVE-2025-31324 SAP NetWeaver intrusions a planted wbemcomn.dll was side-loaded by svchost to run a Cobalt Strike beacon. Because the legitimate library lives only in system directories, execution from other paths is a strong compromise signal.

Malicious Lazarus SIGNBT DLL Side-Loading via PCHealthCheck Host (via image_load)

This rule detects the Microsoft PC Health Check binary PCHealthCheck.exe loading a PCHealthCheck.dll from outside standard program directories, the DLL side-loading technique the Lazarus SIGNBT cluster uses to execute malicious code under a signed utility. Restricting to non-program paths separates the abuse from the legitimately installed application.

Suspicious DLL Side-Loading from Non-Standard winsystem Directory

This rule detects a module being loaded from the non-standard C:\winsystem directory used by the STARKVEIL chain to stage side-loaded DLLs alongside a legitimate signed executable. Attackers rely on this masquerading path to run malicious code under a trusted process while evading directory-based allowlists.

Suspicious NSPX30 DLL Side-Loading of comx3 via RsStub (via image_load)

This rule detects the RsStub.exe binary loading comx3.dll, the DLL side-loading chain that launches the NSPX30 implant by abusing a legitimate executable. Loading this attacker-supplied DLL into a trusted process delivers the AitM-enabled backdoor while evading signature checks.

Suspicious Delphi Runtime DLL Side-Loading by Ahnenblatt Host Process

This rule detects the Ahnenblatt application loading the Borland Delphi runtime DLLs borlndmm.dll or cc32290mt.dll from a user-writable directory. The RenEngine campaign side-loaded these DLL names to execute the HijackLoader stage under a trusted signed process as documented by Kaspersky. Loading these runtime libraries from Temp or AppData indicates DLL search-order hijacking used to run malicious code with a benign parent.

Possible DLL Side-Loading via printui.exe Outside System32

This rule detects execution of printui.exe from a directory outside the legitimate System32 path which enables side-loading of a rogue printui.dll. The Tangerine Turkey campaign copies printui.exe next to a malicious printui.dll to load cryptomining code. Detecting execution from unexpected paths surfaces DLL search order hijacking used for evasion and code execution.

Malicious BLOODALCHEMY DLL Side-Loading via BrDifxapi Executable

This rule detects DLL side-loading where the BrDifxapi executable loads a BrLogAPI DLL which is the loading chain the BLOODALCHEMY backdoor abuses to execute its payload. Pairing this specific host binary with this specific module name reflects a known malicious side-loading combination rather than legitimate Brother software behavior.

Suspicious Extexport DLL Side-Loading Execution

This rule detects execution of the Internet Explorer Extexport.exe utility which loads mozcrt19, mozsqlite3 or sqlite3 DLLs from its working directory. In the WithSecure Code Execution and Persistence Lab 1 the Astaroth chain drops malicious DLLs of these names next to Extexport.exe to achieve DLL side-loading. Attackers proxy code execution through this signed LOLBin to run their payload under a trusted process.

Suspicious FL Studio Executable Side-Loading flengine DLL From Non-Standard Path

This rule detects the legitimate FL Studio binary fl.exe loading flengine.dll from a directory outside its normal installation path which is the DLL side-loading technique used to launch the BITSLOTH backdoor. Adversaries abuse this trusted signed executable to proxy execution of malicious code and evade defenses.

Suspicious calc.exe Execution From Non-System Directory via DLL Side-Loading

This rule detects the Windows Calculator binary calc.exe running from a directory other than System32 or SysWOW64. The revived Qbot banking trojan copies a legitimate calc.exe alongside a malicious WindowsCodecs.dll so the trusted binary side-loads attacker code. Running a signed system binary from an unexpected path is a common evasion that lets malware execute under a benign process name.

Suspicious UAT-8302 DLL Side-Loading via Signed Application Launcher

This rule detects the UAT-8302 side-load launchers Yandex.exe or VMtools.exe invoked with the campaign-specific -r and -p:ini arguments that trigger loading of a malicious DLL and its encrypted configuration. Abusing a benign signed application to load attacker code lets the CloudSorcerer implant execute under a trusted process. The paired argument pattern narrows this to malicious side-loading rather than normal use.

Suspicious CoffeeLoader Execution via Armoury Crate DLL Side-Loading (via process_creation)

This rule detects rundll32 executing the ArmouryAIOSDK.dll with the Post_EntrypointReturn export that CoffeeLoader uses to run its stager through DLL side-loading of ASUS Armoury Crate. Legitimate Armoury Crate components are not invoked this way from user writable paths.