Sigma detection rules, expert-reviewed

Possible DLL Side-Loading via DicomPortable Spawned by ITarian RmmService

This rule detects DicomPortable launched by the ITarian RmmService process which the phishing RMM campaigns abuse to side-load HijackLoader and DeerStealer through a trojanized DLL. Chaining a legitimate RMM service into a vulnerable portable binary lets adversaries execute malware under a trusted parent. Detecting this parent-child pair surfaces DLL search order hijacking used for stealer delivery.

Malicious DLL Side-Loading of SBAMBRES.DLL by VIPRE Binary via DeedRAT (via image_load)

This rule detects the legitimate VIPRE MambaSafeModeUI.exe binary loading SBAMBRES.DLL from the ProgramData Micro directory, the side-loading step that launches the DeedRAT backdoor. Genuine VIPRE components load this DLL from their install directory, not ProgramData.

Malicious APT29 DLL Side-Loading via msoev.exe from Windows Tasks Directory (via process_creation)

This rule detects the signed msoev binary executing from the Windows Tasks directory, the side-loading launcher APT29 used to load the Duke malware in the German Embassy lure campaign. Running this legitimate binary from C:\Windows\Tasks side-loads a malicious Mso DLL from the same folder. Execution of msoev from this path is highly anomalous.

Malicious Lazarus DLL Side-Loading of ualapi.dll via spoolsv.exe (via image_load)

This rule detects the Windows Print Spooler process spoolsv.exe loading a ualapi.dll from a directory other than System32. In the Lazarus SIGNBT campaign the actor plants a rogue ualapi.dll that is side-loaded by spoolsv.exe to gain execution and persistence, so a ualapi.dll load from an unusual path indicates print-processor abuse and hijacked system code.

Suspicious Imjp14k DLL Side-Loading From Non-System Path

This rule detects a process loading imjp14k.dll from a path outside the standard Windows System32 directory. APT41 abused DLL side-loading of imjp14k.dll to launch ShadowPad on a compromised Taiwanese network. Side-loading a system-named DLL from a writable non-system directory is a hallmark of hijack execution used to run malicious code under a trusted host process.

Suspicious Renamed MonitoringHost Binary Indicating DLL Side-Loading

This rule detects execution of the signed Microsoft MonitoringHost binary under a renamed file name, a technique used by the SADBRIDGE loader to deploy the GOSAR (Golang QUASAR) backdoor. SADBRIDGE renames MonitoringHost.exe to DevQueryBroker.exe and abuses DLL search order hijacking to side-load a malicious HealthServiceRuntime.dll. Detecting a mismatch between the original file name and the on-disk image name surfaces this masquerading and side-loading activity for triage.

Malicious DLL Side-Loading of msimg32 via Silverlight.Configuration.exe

This rule detects Silverlight.Configuration.exe loading msimg32.dll from outside the Windows system directories. The Horns and Hooves campaign abused this signed binary to side-load a planted msimg32.dll and execute the NetSupport loader under a trusted process.

Malicious DtlCrashCatch DLL Side-Loading via OneDrive Sync Service by SPECTRALVIPER

This rule detects the OneDrive.Sync.Service.exe process loading DtlCrashCatch.dll, a side-loaded and injected module used by the SPECTRALVIPER backdoor. This activity is associated with the OceanLotus (APT32) espionage campaign that abuses a trusted signed OneDrive binary for DLL search-order hijacking. Catching this specific side-load is important because it reveals code injection and stealthy execution under a legitimate process context.

Malicious PlugX DLL Side-Loading via LMIGuardianSvc from SamsungDriver Directory (via process_creation)

This rule detects the legitimate LMIGuardianSvc binary executing from a SamsungDriver directory created by Mustang Panda to side-load PlugX. The signed binary search-order loads a malicious LMIGuardianDll from this attacker-controlled path. Running this LogMeIn component from a non-standard user directory is anomalous.

Malicious DLL Side-Loading via AVGApplicationFrameHost

This rule detects the AVGApplicationFrameHost.exe binary loading a wsc.dll module, a DLL side-loading chain used by TheWizards APT group to execute the WizardNet backdoor alongside an encrypted log.dat shellcode payload. Abusing a signed AV-related host process to load an attacker DLL evades trust controls and blends malicious execution into legitimate software.

Malicious regsvr32.exe Spawned by calc.exe via DLL Side-Loading

This rule detects regsvr32.exe launched with the Windows Calculator calc.exe as its parent process. During Qbot infections the side-loaded calc.exe uses regsvr32 to register and execute the trojan payload DLL. Calculator legitimately never spawns regsvr32, so this parent-child chain is a strong indicator of DLL side-loading and proxied code execution.

Suspicious DLL Side-Loading via vssvc or WorkFolders

This rule detects the trusted binaries vssvc.exe or WorkFolders.exe loading a DLL from outside the Windows system directories. SideWinder abused DLL side-loading against these signed executables to run malicious code under a legitimate process, and loads from non-system paths indicate a planted DLL.

Suspicious LucidRook DLL Side-Loading via Renamed msedge.exe

This rule detects msedge.exe executing from a WindowsApps directory under the user profile, matching the LucidRook loader that renames the DISM index.exe binary to msedge.exe to side-load a malicious DismCore.dll. Legitimate Microsoft Edge runs from Program Files, so an msedge.exe launched from AppData WindowsApps is an impostor used for search-order hijacking. This behavior indicates initial execution of the Lua-based LucidRook malware.

Malicious DLL Side-Loading of vcl120.bpl From AppData via HijackLoader (via image_load)

This rule detects a vcl120.bpl Delphi runtime package being loaded from a user AppData Roaming directory, the side-loading step used by the IObit-abusing HijackLoader to stage AsyncRAT. The legitimate vcl120.bpl resides with its application, not under AppData.

DLL Side-Loading of WebUI.dll via Iscrpaint Host Binary

This rule detects the iscrpaint.exe binary loading WebUI.dll, the DLL side-loading pair used to run LummaStealer under a signed host process. Loading this companion DLL from the malware staging directory indicates search-order hijacking rather than legitimate application behavior.