Sigma detection rules, expert-reviewed

Suspicious ADNotificationManager Execution for netutils.dll Side-Loading (via process_creation)

This rule detects the Adobe ADNotificationManager.exe binary running from a user writable directory rather than its installed Adobe program path, where the RedCurl EarthKapre APT side-loads a malicious netutils.dll. Relocating the signed executable lets the attacker force loading of an attacker controlled library beside it. Execution of this Adobe component from a temporary or profile path is a strong side-loading indicator.

Malicious JanelaRAT DLL Side-Loading via nevasca.exe (via image_load)

This rule detects the host binary nevasca.exe loading the malicious PixelPaint.dll used by JanelaRAT to hijack execution flow through DLL side-loading. JanelaRAT is a financial remote access trojan targeting users in Latin America. Detecting this loader pair exposes the in-memory execution of the RAT before command-and-control is established.

Malicious CRYPTBASE.dll Side-Loading Outside System32

This rule detects CRYPTBASE.dll being loaded from a directory outside the Windows System32 folder. The CPU-Z and HWMonitor watering-hole campaign side-loaded a malicious CRYPTBASE.dll next to a trusted binary to hijack execution as reported by Kaspersky. Because the genuine CRYPTBASE.dll ships only in System32, loading it from any other path is a reliable DLL search-order hijack indicator.

Windows DLL Side-Loading: OleView loading aclui.dll

Alerts on OleView.exe loading aclui.dll on Windows, excluding common benign paths to highlight potential DLL side-loading.

Windows DLL side-loading: KeyScramblerIE.DLL loaded by KeyScrambler.exe

Alerts on KeyScrambler.exe loading KeyScramblerIE.dll, a common DLL side-loading pattern that may indicate malicious library execution.

Windows DLL Side-Loading via ProgramData Image Load Indicators (clip.exe and wsmprovhost.exe)

Flags ProgramData clip.exe or wsmprovhost.exe launching with suspicious DLL loads from ProgramData.

Windows DLL side-loading via appverifUI.dll image loads

Alerts when appverifUI.dll is loaded on Windows from unexpected paths, a common DLL sideloading technique.

Windows DLL Sideloading Suspicion via edputil.dll Image Load

Alerts on edputil.dll image loads occurring outside standard Windows system directories, suggesting possible DLL side-loading.

Windows Wazuh Platform DLL Side-Loading via ImageLoad of libwazuhshared.dll

Alerts on suspicious loading of Wazuh platform DLLs in Windows image load telemetry, excluding common Program Files and Mingw64 patterns.

Windows vmnat.exe Renamed Execution for Possible DLL Side-Loading

Alerts on Windows processes where vmnat.exe appears renamed, which may support stealthy execution and DLL side-loading behavior.

Windows Defender mpclient.dll Side-loading: MpCmdRun.exe or NisSrv.exe from Non-Default Paths

Alerts when MpCmdRun.exe or NisSrv.exe runs from non-default directories, a common indicator of possible mpclient.dll sideloading.

Windows: msdt.exe Loads sdiageng.dll via Image Load Events

Flags msdt.exe image-load events that load sdiageng.dll, a behavior commonly associated with DLL side-loading abuse.

Windows: Xwizard.exe Execution from Non-Default Directory

Alerts when Xwizard.exe starts from an unexpected Windows path, indicating potential misuse or side-loading.

Windows Fax Service ualapi.dll Side-Loading via fxssvc.exe

Flags fxssvc.exe loading ualapi.dll from unexpected paths, indicating potential DLL side-loading for privilege escalation.

Windows process creation: svchost.exe launched by sllauncher.exe for DLL side-loading

Flags AppData\Roaming-launched svchost.exe instances spawned by sllauncher.exe with -k, matching DLL side-loading execution behavior.