Sigma detection rules, expert-reviewed

Suspicious DLL Side-Loading of wbemcomn From Non-System Path

This rule detects loading of wbemcomn.dll from a directory outside the Windows system folders, indicating DLL side-loading. In CVE-2025-31324 SAP NetWeaver intrusions a planted wbemcomn.dll was side-loaded by svchost to run a Cobalt Strike beacon. Because the legitimate library lives only in system directories, execution from other paths is a strong compromise signal.

Malicious Lazarus SIGNBT DLL Side-Loading via PCHealthCheck Host (via image_load)

This rule detects the Microsoft PC Health Check binary PCHealthCheck.exe loading a PCHealthCheck.dll from outside standard program directories, the DLL side-loading technique the Lazarus SIGNBT cluster uses to execute malicious code under a signed utility. Restricting to non-program paths separates the abuse from the legitimately installed application.

Suspicious DLL Side-Loading from Non-Standard winsystem Directory

This rule detects a module being loaded from the non-standard C:\winsystem directory used by the STARKVEIL chain to stage side-loaded DLLs alongside a legitimate signed executable. Attackers rely on this masquerading path to run malicious code under a trusted process while evading directory-based allowlists.

Suspicious NSPX30 DLL Side-Loading of comx3 via RsStub (via image_load)

This rule detects the RsStub.exe binary loading comx3.dll, the DLL side-loading chain that launches the NSPX30 implant by abusing a legitimate executable. Loading this attacker-supplied DLL into a trusted process delivers the AitM-enabled backdoor while evading signature checks.

Suspicious Delphi Runtime DLL Side-Loading by Ahnenblatt Host Process

This rule detects the Ahnenblatt application loading the Borland Delphi runtime DLLs borlndmm.dll or cc32290mt.dll from a user-writable directory. The RenEngine campaign side-loaded these DLL names to execute the HijackLoader stage under a trusted signed process as documented by Kaspersky. Loading these runtime libraries from Temp or AppData indicates DLL search-order hijacking used to run malicious code with a benign parent.

Possible DLL Side-Loading via printui.exe Outside System32

This rule detects execution of printui.exe from a directory outside the legitimate System32 path which enables side-loading of a rogue printui.dll. The Tangerine Turkey campaign copies printui.exe next to a malicious printui.dll to load cryptomining code. Detecting execution from unexpected paths surfaces DLL search order hijacking used for evasion and code execution.

Malicious BLOODALCHEMY DLL Side-Loading via BrDifxapi Executable

This rule detects DLL side-loading where the BrDifxapi executable loads a BrLogAPI DLL which is the loading chain the BLOODALCHEMY backdoor abuses to execute its payload. Pairing this specific host binary with this specific module name reflects a known malicious side-loading combination rather than legitimate Brother software behavior.

Suspicious Extexport DLL Side-Loading Execution

This rule detects execution of the Internet Explorer Extexport.exe utility which loads mozcrt19, mozsqlite3 or sqlite3 DLLs from its working directory. In the WithSecure Code Execution and Persistence Lab 1 the Astaroth chain drops malicious DLLs of these names next to Extexport.exe to achieve DLL side-loading. Attackers proxy code execution through this signed LOLBin to run their payload under a trusted process.

Suspicious FL Studio Executable Side-Loading flengine DLL From Non-Standard Path

This rule detects the legitimate FL Studio binary fl.exe loading flengine.dll from a directory outside its normal installation path which is the DLL side-loading technique used to launch the BITSLOTH backdoor. Adversaries abuse this trusted signed executable to proxy execution of malicious code and evade defenses.

Suspicious calc.exe Execution From Non-System Directory via DLL Side-Loading

This rule detects the Windows Calculator binary calc.exe running from a directory other than System32 or SysWOW64. The revived Qbot banking trojan copies a legitimate calc.exe alongside a malicious WindowsCodecs.dll so the trusted binary side-loads attacker code. Running a signed system binary from an unexpected path is a common evasion that lets malware execute under a benign process name.

Suspicious UAT-8302 DLL Side-Loading via Signed Application Launcher

This rule detects the UAT-8302 side-load launchers Yandex.exe or VMtools.exe invoked with the campaign-specific -r and -p:ini arguments that trigger loading of a malicious DLL and its encrypted configuration. Abusing a benign signed application to load attacker code lets the CloudSorcerer implant execute under a trusted process. The paired argument pattern narrows this to malicious side-loading rather than normal use.

Suspicious CoffeeLoader Execution via Armoury Crate DLL Side-Loading (via process_creation)

This rule detects rundll32 executing the ArmouryAIOSDK.dll with the Post_EntrypointReturn export that CoffeeLoader uses to run its stager through DLL side-loading of ASUS Armoury Crate. Legitimate Armoury Crate components are not invoked this way from user writable paths.

Malicious Unsigned libConfigurer64 Dylib Side-Loading via Image Load

This rule detects loading of the libConfigurer64 dylib which pirated macOS applications side-load to execute the bundled Khepri implant. This uniquely named unsigned library is the loading mechanism of the campaign so its appearance indicates a trojanized pirated app running malicious code.

Malicious GHOSTPULSE DLL Side-Loading of libcurl via VBoxSVC

This rule detects the VirtualBox VBoxSVC executable loading a libcurl DLL from outside its normal installation directory which is the side-loading path GHOSTPULSE abuses to execute its stager. The rule excludes loads from genuine VirtualBox directories to focus on the malicious wrong context placement.

Malicious PlugX DLL Side-Loading via iviewers OLE Object Viewer (via image_load)

This rule detects the legitimate iviewers.exe OLE COM Object Viewer loading a co-located iviewers.dll from a non standard directory such as ProgramData. Velvet Ant abused DLL search order hijacking against this signed Windows SDK utility to load a PlugX loader and payload. Legitimate use of this tool loads its DLL from the SDK installation directory only.