Every published rule

Windows DLL Side-Loading: OleView loading aclui.dll

Alerts on OleView.exe loading aclui.dll on Windows, excluding common benign paths to highlight potential DLL side-loading.

Windows DLL side-loading: KeyScramblerIE.DLL loaded by KeyScrambler.exe

Alerts on KeyScrambler.exe loading KeyScramblerIE.dll, a common DLL side-loading pattern that may indicate malicious library execution.

Windows DLL Side-Loading via ProgramData Image Load Indicators (clip.exe and wsmprovhost.exe)

Flags ProgramData clip.exe or wsmprovhost.exe launching with suspicious DLL loads from ProgramData.

Windows DLL side-loading via appverifUI.dll image loads

Alerts when appverifUI.dll is loaded on Windows from unexpected paths, a common DLL sideloading technique.

Windows DLL Sideloading Suspicion via edputil.dll Image Load

Alerts on edputil.dll image loads occurring outside standard Windows system directories, suggesting possible DLL side-loading.

Windows Wazuh Platform DLL Side-Loading via ImageLoad of libwazuhshared.dll

Alerts on suspicious loading of Wazuh platform DLLs in Windows image load telemetry, excluding common Program Files and Mingw64 patterns.

Windows vmnat.exe Renamed Execution for Possible DLL Side-Loading

Alerts on Windows processes where vmnat.exe appears renamed, which may support stealthy execution and DLL side-loading behavior.

Windows Defender mpclient.dll Side-loading: MpCmdRun.exe or NisSrv.exe from Non-Default Paths

Alerts when MpCmdRun.exe or NisSrv.exe runs from non-default directories, a common indicator of possible mpclient.dll sideloading.

Windows: msdt.exe Loads sdiageng.dll via Image Load Events

Flags msdt.exe image-load events that load sdiageng.dll, a behavior commonly associated with DLL side-loading abuse.

Windows: Xwizard.exe Execution from Non-Default Directory

Alerts when Xwizard.exe starts from an unexpected Windows path, indicating potential misuse or side-loading.

Windows Fax Service ualapi.dll Side-Loading via fxssvc.exe

Flags fxssvc.exe loading ualapi.dll from unexpected paths, indicating potential DLL side-loading for privilege escalation.

Windows process creation: svchost.exe launched by sllauncher.exe for DLL side-loading

Flags AppData\Roaming-launched svchost.exe instances spawned by sllauncher.exe with -k, matching DLL side-loading execution behavior.

Windows Process Creation: Suspicious Execution of PlugX DLL Side-Loading Utilities from Uncommon Paths

Alerts on execution of PlugX-related helper binaries from atypical paths, excluding common legitimate directories.