Sigma detection rules, expert-reviewed

Suspicious MpClient DLL Sideload from Non-Defender Path

This rule detects a module named MpClient.dll being loaded from a path outside the Windows Defender installation tree. The Vidar campaign plants a fake MpClient.dll for search-order sideloading into a Defender-named host process. Catching the trusted DLL name loading from an unexpected location reveals DLL sideloading used to evade defenses.

Suspicious DLL Sideload of uevmonitor via SoftwareLicencing (via image_load)

This rule detects SoftwareLicencing.exe loading uevmonitor.dll, a DLL side-loading chain used by Screening Serpens to execute malicious code under a trusted-looking host process. The sideloaded module runs the group's dispatcher and command-and-control logic.

Suspicious DLL Load From ProgramData Intel Sideload Path (via image_load)

This rule detects DLLs loaded from a C:\ProgramData\intel sideload path used by threat clusters targeting a Southeast Asian government organization to run EggStremeFuel and related implants via search-order hijacking. Legitimate signed applications rarely load libraries from ProgramData, so a module loaded from this location indicates DLL sideloading.

Malicious DLL Side-Loading via Renamed BluetoothService.exe Loading log.dll (via image_load)

This rule detects a process named BluetoothService.exe loading log.dll, the DLL side-loading chain from the Notepad++ supply-chain compromise where a renamed signed Bitdefender binary loads the malicious log.dll. Running the Chrysalis payload under a trusted signed loader evades defenses and hides the implant.

Malicious Gh0st RAT DLL Side-Loading via wsc_proxy Loading wsc.dll (via image_load)

This rule detects the signed helper wsc_proxy.exe loading a wsc.dll module, the DLL side-loading chain abused by impersonation campaigns distributing Gh0st RAT. Adversaries drop a malicious wsc.dll beside the trusted loader so the payload runs under a benign process, evading endpoint defenses and establishing covert execution.

Malicious DLL Side-Loading via 7z or clink Loaders

This rule detects the 7z or clink binaries side-loading their companion DLLs from non-standard locations. Project AK47 abuses 7z.exe with a malicious 7z.dll and clink_x86.exe with clink_dll_x86.dll to execute payloads under trusted binaries. Loading these DLLs outside their normal install directories indicates search-order hijacking.

Suspicious mscorsvw Side-Loading mscorsvc DLL from Assembly Path

This rule detects mscorsvw.exe loading mscorsvc.dll from the Windows assembly directory. The covert C2 backdoor plants a malicious mscorsvc.dll in this path so the trusted .NET optimizer side-loads it. This DLL hijack lets the attacker execute code under a signed Microsoft process.

Malicious DLL Side-Loading via DingTalk Loading zlibwapi

This rule detects the legitimate DingTalk.exe binary loading a zlibwapi.dll from outside standard install paths. In the SLOW#TEMPEST intrusion attackers abuse DingTalk to side-load a malicious zlibwapi.dll that carries the ipc_core.dll payload. Trusted signed binary loading an unsigned helper DLL from an unexpected directory is a classic DLL search-order hijack.

Suspicious Loading of ieapfltr From User Internet Explorer Folder

This rule detects the ieapfltr.dll module loaded from a user AppData Internet Explorer folder instead of the system directory. The Blitz downloader plants a malicious ieapfltr.dll in the local AppData Internet Explorer path to be side-loaded. A trusted system library name executing from a user path indicates DLL side-loading.

Suspicious HeartCrypt Sandbox Detection DLL Load

This rule detects loading of the decoy modules k7rn7l32.dll and ntd3ll.dll used by the HeartCrypt packer for sandbox and analysis detection. This behavior matches HeartCrypt packed samples that attempt to load these non-existent typosquatted DLLs to probe emulated environments. These filenames are unique artifacts of the packer and provide a reliable signal of HeartCrypt-protected malware.

Malicious Vulnerable Driver Load for EDR Evasion (via image_load)

This rule detects loading of the wnbios.sys or WN_64.sys vulnerable drivers, the bring-your-own-vulnerable-driver components an extortion actor paired with the EDRSandBlast disabler.exe tool to blind endpoint security. Loading a known-abusable signed driver grants kernel access used to unhook or terminate EDR agents.

Suspicious i4jinst DLL Sideload via Spoofed GlobalProtect by WikiLoader

This rule detects the i4jinst.dll being loaded from an install4j directory by a spoofed GlobalProtect binary, the DLL search order hijack a unique WikiLoader variant uses to gain execution from a fake VPN installer. Sideloading a bundled DLL lets the loader run under the guise of legitimate software. Detecting this exposes the WikiLoader delivery stage.

Malicious KeyScrambler DLL Sideloading from Public Libraries (via image_load)

This rule detects a KeyScramblerIE.dll being loaded from a subdirectory of the public libraries folder, the DLL sideloading location a Chinese APT used against ASEAN entities by pairing a renamed KeyScrambler executable with a malicious library. Legitimate KeyScrambler components do not reside under Users Public Libraries, so this load path indicates a staged sideloading chain for stealthy execution.

Malicious CatB Ransomware Oci.dll Hijack via Msdtc (via image_load)

This rule detects the Microsoft Distributed Transaction Coordinator service loading an oci.dll, the phantom DLL hijack CatB ransomware abuses by planting its payload in System32 where msdtc.exe searches for the absent Oracle Call Interface library. Windows ships no oci.dll by default, so this load reliably indicates the CatB persistence and execution mechanism rather than a genuine Oracle dependency.

Malicious SentinelOne DLL Sideloading via SentinelUI (via image_load)

This rule detects the SentinelUI executable loading a SentinelAgentCore.dll from a location outside the legitimate SentinelOne installation directory, the DLL search order hijack used by actors exploiting the ConnectWise ScreenConnect flaws to deploy Cobalt Strike and LockBit. Sideloading through a trusted security agent name lets the payload execute with reduced suspicion, so an off path load of this pairing indicates active post exploitation.