Sigma detection rules, expert-reviewed

Malicious Kazuar DLL Side-Loading via Renamed Host Binaries

This rule detects execution of vncutil64.exe or LaunchGFExperience.exe, host binaries abused via DLL side-loading to restart the Turla Kazuar backdoor during a Gamaredon and Turla collaboration. These legitimately named executables running from non-standard locations serve as loaders for a malicious sideloaded DLL and indicate espionage backdoor activity.

Malicious Lazarus DLL Side-Loading via Colorcpl from ProgramData (via process_creation)

This rule detects the signed binary colorcpl.exe executing from a ProgramData path, the vector Lazarus used to side-load a malicious colorui.dll from C ProgramData Adobe during the trojanized coding-challenge intrusion. Because colorcpl normally runs from System32, execution from ProgramData reveals a side-loaded payload launch.

Malicious Lazarus DLL Side-Loading via PresentationHost from Non-Standard Path (via process_creation)

This rule detects the signed Microsoft binary PresentationHost.exe executing from a location outside System32 or SysWOW64, the DLL side-loading vector used by Lazarus to load a malicious mscoree.dll from C ProgramShared in the trojanized coding-challenge campaign. Running this LOLBin from a writable path indicates a side-loading launch of the group's implant.

Suspicious Evasive Panda DLL Side-Loading via MonlamUpdate (via image_load)

This rule detects the MonlamUpdate.exe binary loading RPHost.dll, a DLL side-loading link in the Evasive Panda infection chain targeting Tibetans during the Monlam Festival. Abusing this trusted-looking updater to load a malicious DLL advances the group's downloader and backdoor deployment.

Suspicious rnpkeys Execution from AppData for DLL Side-Loading (via process_creation)

This rule detects the legitimate RNP key utility rnpkeys.exe running from a user AppData Roaming path, where LummaC2 side-loads a malicious rnp.dll to gain execution. The signed binary is relocated into a fake application folder so its adjacent DLL is loaded instead of the genuine library. Execution of this developer tool from a user writable profile directory is highly abnormal.

Malicious MpGear.dll Side-Loading by Signed Host Binary

This rule detects the load of MpGear.dll, the malicious library side-loaded by a signed Inspection Document Review executable in the SyncFuture campaign. The DLL carried a transplanted invalid Microsoft signature and ran attacker code under a trusted signed host process. The presence of this named side-loaded module indicates active SyncFuture tradecraft.

Malicious msedge_elf.dll Side-Loading from Public Libraries

This rule detects the Edge helper library msedge_elf.dll being loaded from the C:\Users\Public\Libraries directory instead of a legitimate browser install path. ChaosBot side-loaded a malicious msedge_elf.dll through identity_helper.exe placed in Public Libraries to run its Rust payload under a trusted process. A signed Microsoft DLL name loading from a world-writable staging path is a hallmark of DLL side-loading.

Malicious Libcurl DLL Side-Loading by Paint Backdoor (via image_load)

This rule detects the BRUSHWORM paint.exe backdoor side-loading a malicious libcurl.dll from a non-standard directory. Observed in Elastic Security Labs analysis where DLL search order hijacking of libcurl.dll executes attacker code under a benign-looking process against financial services.

Suspicious GHOSTPULSE DLL Side-Loading via Signed Binary

This rule detects the signed application Crysta_X64.exe loading the attacker-supplied DllXDownloadManager.dll, the DLL side-loading pair used to launch the GHOSTPULSE loader. Adversaries abuse this trusted executable to proxy execution of malicious code while evading application controls before deploying the ARECHCLIENT2 stealer.

Suspicious DLL Side-Loading by Microsoft.Http.Api.exe via HTTPService.dll

This rule detects Microsoft.Http.Api.exe loading HTTPService.dll from a user AppData directory as part of the SHELBY backdoor DLL side-loading chain. The signed decoy executable is abused to load an attacker-controlled DLL that stages further payloads. This behavior indicates DLL search-order hijacking used to evade application controls and establish execution.

Malicious ChargeWeapon DLL Side-Loading via mcods.exe (via image_load)

This rule detects the McAfee mcods binary loading mcvsocfg.dll, the side-loading pair used to deliver the ChargeWeapon downloader in the semiconductor espionage campaign. The malicious loader reads an encrypted configuration and injects shellcode when loaded by the signed binary. This host and module combination is a reliable side-loading indicator.

Malicious HyperBro DLL Side-Loading via vfhost.exe (via image_load)

This rule detects the CyberArk vfhost binary loading VFTRACE.dll, the side-loading pair used to deploy the HyperBro implant against semiconductor targets. The malicious DLL decrypts and injects Cobalt Strike shellcode when loaded by the signed host process. This specific host and module pairing indicates HyperBro side-loading.

DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL

This rule detects trusted signed executables side-loading helper DLLs commonly abused for DLL search-order hijacking such as GUP.exe loading libcurl.dll or MsMpEng.exe loading mpsvc.dll. This technique was widely abused by PlugX and related tooling to run malicious code under the guise of a legitimate signed process, and the rule filters the legitimate Windows Defender load path.

Malicious DLL Side-Loading of vcomp100 via converter.exe

This rule detects the ImageMagick converter.exe loading vcomp100.dll from outside the Windows system directories. The IDAT loader chain delivering Vidar and ACR stealers abused this signed binary to side-load a malicious vcomp100.dll and execute stager code under a trusted process.

DLL Side-Loading of NvSmartMax via NvSmart Host Process

This rule detects the nvSmartEx.exe host loading NvSmartMax.dll from outside the legitimate NVIDIA program directory, the DLL side-loading pair used by DeadRinger actors to run implant code. A trusted NVIDIA binary loading its companion DLL from an unexpected path indicates search-order hijacking.