{"id":"4fc0deee-0057-4998-ab31-d24e46e0aba4","title":"Potential System DLL Sideloading From Non System Locations","description":"Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-14","modified":"2025-12-03","tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.001"],"technique_ids":["T1574.001"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Legitimate applications loading their own versions of the DLLs mentioned in this rule"],"references":["https://hijacklibs.net/","https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/","https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/","https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md","https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/"],"source_path":"rules/windows/image_load/image_load_side_load_from_non_system_location.yml","source_sha256":"3ff0168cdc8111ef97e6a9c9058c6511fb43af3756e5f59c601e2f315947f2c6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_side_load_from_non_system_location.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential System DLL Sideloading From Non System Locations\nid: 4fc0deee-0057-4998-ab31-d24e46e0aba4\nstatus: test\ndescription: Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).\nreferences:\n    - https://hijacklibs.net/ # For list of DLLs that could be sideloaded (search for dlls mentioned here in there). Wietze Beukema (project and research)\n    - https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/ # WindowsCodecs.dll\n    - https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/ # iphlpapi.dll\n    - https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md # XForceIR (SideLoadHunter Project), Chris Spehn (research WFH Dridex)\n    - https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-08-14\nmodified: 2025-12-03\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.001\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        ImageLoaded|endswith:\n            - '\\aclui.dll'\n            - '\\activeds.dll'\n            - '\\adsldpc.dll'\n            - '\\aepic.dll'\n            - '\\apphelp.dll'\n            - '\\applicationframe.dll'\n            - '\\appvpolicy.dll'\n            - '\\appxalluserstore.dll'\n            - '\\appxdeploymentclient.dll'\n            - '\\archiveint.dll'\n            - '\\atl.dll'\n            - '\\audioses.dll'\n            - '\\auditpolcore.dll'\n            - '\\authfwcfg.dll'\n            - '\\authz.dll'\n            - '\\avrt.dll'\n            - '\\batmeter.dll'\n            - '\\bcd.dll'\n            - '\\bcp47langs.dll'\n            - '\\bcp47mrm.dll'\n            - '\\bcrypt.dll'\n            - '\\bderepair.dll'\n            - '\\bootmenuux.dll'\n            - '\\bootux.dll'\n            - '\\cabinet.dll'\n            - '\\cabview.dll'\n            - '\\certcli.dll'\n            - '\\certenroll.dll'\n            - '\\cfgmgr32.dll'\n            - '\\cldapi.dll'\n            - '\\clipc.dll'\n            - '\\clusapi.dll'\n            - '\\cmpbk32.dll'\n            - '\\cmutil.dll'\n            - '\\coloradapterclient.dll'\n            - '\\colorui.dll'\n            - '\\comdlg32.dll'\n            - '\\configmanager2.dll'\n            - '\\connect.dll'\n            - '\\coredplus.dll'\n            - '\\coremessaging.dll'\n            - '\\coreuicomponents.dll'\n            - '\\credui.dll'\n            - '\\cryptbase.dll'\n            - '\\cryptdll.dll'\n            - '\\cryptsp.dll'\n            - '\\cryptui.dll'\n            - '\\cryptxml.dll'\n            - '\\cscapi.dll'\n            - '\\cscobj.dll'\n            - '\\cscui.dll'\n            - '\\d2d1.dll'\n            - '\\d3d10_1.dll'\n            - '\\d3d10_1core.dll'\n            - '\\d3d10.dll'\n            - '\\d3d10core.dll'\n            - '\\d3d10warp.dll'\n            - '\\d3d11.dll'\n            - '\\d3d12.dll'\n            - '\\d3d9.dll'\n            - '\\d3dx9_43.dll'\n            - '\\dataexchange.dll'\n            - '\\davclnt.dll'\n            - '\\dcntel.dll'\n            - '\\dcomp.dll'\n            - '\\defragproxy.dll'\n            - '\\desktopshellext.dll'\n            - '\\deviceassociation.dll'\n            - '\\devicecredential.dll'\n            - '\\devicepairing.dll'\n            - '\\devobj.dll'\n            - '\\devrtl.dll'\n            - '\\dhcpcmonitor.dll'\n            - '\\dhcpcsvc.dll'\n            - '\\dhcpcsvc6.dll'\n            - '\\directmanipulation.dll'\n            - '\\dismapi.dll'\n            - '\\dismcore.dll'\n            - '\\dmcfgutils.dll'\n            - '\\dmcmnutils.dll'\n            - '\\dmcommandlineutils.dll'\n            - '\\dmenrollengine.dll'\n            - '\\dmenterprisediagnostics.dll'\n            - '\\dmiso8601utils.dll'\n            - '\\dmoleaututils.dll'\n            - '\\dmprocessxmlfiltered.dll'\n            - '\\dmpushproxy.dll'\n            - '\\dmxmlhelputils.dll'\n            - '\\dnsapi.dll'\n            - '\\dot3api.dll'\n            - '\\dot3cfg.dll'\n            - '\\dpx.dll'\n            - '\\drprov.dll'\n            - '\\drvstore.dll'\n            - '\\dsclient.dll'\n            - '\\dsparse.dll'\n            - '\\dsprop.dll'\n            - '\\dsreg.dll'\n            - '\\dsrole.dll'\n            - '\\dui70.dll'\n            - '\\duser.dll'\n            - '\\dusmapi.dll'\n            - '\\dwmapi.dll'\n            - '\\dwmcore.dll'\n            - '\\dwrite.dll'\n            - '\\dxcore.dll'\n            - '\\dxgi.dll'\n            - '\\dxva2.dll'\n            - '\\dynamoapi.dll'\n            - '\\eappcfg.dll'\n            - '\\eappprxy.dll'\n            - '\\edgeiso.dll'\n            - '\\edputil.dll'\n            - '\\efsadu.dll'\n            - '\\efsutil.dll'\n            - '\\esent.dll'\n            - '\\execmodelproxy.dll'\n            - '\\explorerframe.dll'\n            - '\\fastprox.dll'\n            - '\\faultrep.dll'\n            - '\\fddevquery.dll'\n            - '\\feclient.dll'\n            - '\\fhcfg.dll'\n            - '\\fhsvcctl.dll'\n            - '\\firewallapi.dll'\n            - '\\flightsettings.dll'\n            - '\\fltlib.dll'\n            - '\\framedynos.dll'\n            - '\\fveapi.dll'\n            - '\\fveskybackup.dll'\n            - '\\fvewiz.dll'\n            - '\\fwbase.dll'\n            - '\\fwcfg.dll'\n            - '\\fwpolicyiomgr.dll'\n            - '\\fwpuclnt.dll'\n            - '\\fxsapi.dll'\n            - '\\fxsst.dll'\n            - '\\fxstiff.dll'\n            - '\\getuname.dll'\n            - '\\gpapi.dll'\n            - '\\hid.dll'\n            - '\\hnetmon.dll'\n            - '\\httpapi.dll'\n            - '\\icmp.dll'\n            - '\\idstore.dll'\n            - '\\ieadvpack.dll'\n            - '\\iedkcs32.dll'\n            - '\\iernonce.dll'\n            - '\\iertutil.dll'\n            - '\\ifmon.dll'\n            - '\\ifsutil.dll'\n            - '\\inproclogger.dll'\n            - '\\iphlpapi.dll'\n            - '\\iri.dll'\n            - '\\iscsidsc.dll'\n            - '\\iscsium.dll'\n            - '\\isv.exe_rsaenh.dll'\n            - '\\iumbase.dll'\n            - '\\iumsdk.dll'\n            - '\\joinutil.dll'\n            - '\\kdstub.dll'\n            - '\\ksuser.dll'\n            - '\\ktmw32.dll'\n            - '\\licensemanagerapi.dll'\n            - '\\licensingdiagspp.dll'\n            - '\\linkinfo.dll'\n            - '\\loadperf.dll'\n            - '\\lockhostingframework.dll'\n            - '\\logoncli.dll'\n            - '\\logoncontroller.dll'\n            - '\\lpksetupproxyserv.dll'\n            - '\\lrwizdll.dll'\n            - '\\magnification.dll'\n            - '\\maintenanceui.dll'\n            - '\\mapistub.dll'\n            - '\\mbaexmlparser.dll'\n            - '\\mdmdiagnostics.dll'\n            - '\\mfc42u.dll'\n            - '\\mfcore.dll'\n            - '\\mfplat.dll'\n            - '\\mi.dll'\n            - '\\midimap.dll'\n            - '\\mintdh.dll'\n            - '\\miutils.dll'\n            - '\\mlang.dll'\n            - '\\mmdevapi.dll'\n            - '\\mobilenetworking.dll'\n            - '\\mpr.dll'\n            - '\\mprapi.dll'\n            - '\\mrmcorer.dll'\n            - '\\msacm32.dll'\n            - '\\mscms.dll'\n            - '\\mscoree.dll'\n            - '\\msctf.dll'\n            - '\\msctfmonitor.dll'\n            - '\\msdrm.dll'\n            - '\\msdtctm.dll'\n            - '\\msftedit.dll'\n            - '\\msi.dll'\n            - '\\msiso.dll'\n            - '\\msutb.dll'\n            - '\\msvcp110_win.dll'\n            - '\\mswb7.dll'\n            - '\\mswsock.dll'\n            - '\\msxml3.dll'\n            - '\\mtxclu.dll'\n            - '\\napinsp.dll'\n            - '\\ncrypt.dll'\n            - '\\ndfapi.dll'\n            - '\\netapi32.dll'\n            - '\\netid.dll'\n            - '\\netiohlp.dll'\n            - '\\netjoin.dll'\n            - '\\netplwiz.dll'\n            - '\\netprofm.dll'\n            - '\\netprovfw.dll'\n            - '\\netsetupapi.dll'\n            - '\\netshell.dll'\n            - '\\nettrace.dll'\n            - '\\netutils.dll'\n            - '\\networkexplorer.dll'\n            - '\\newdev.dll'\n            - '\\ninput.dll'\n            - '\\nlaapi.dll'\n            - '\\nlansp_c.dll'\n            - '\\npmproxy.dll'\n            - '\\nshhttp.dll'\n            - '\\nshipsec.dll'\n            - '\\nshwfp.dll'\n            - '\\ntdsapi.dll'\n            - '\\ntlanman.dll'\n            - '\\ntlmshared.dll'\n            - '\\ntmarta.dll'\n            - '\\ntshrui.dll'\n            - '\\oleacc.dll'\n            - '\\omadmapi.dll'\n            - '\\onex.dll'\n            - '\\opcservices.dll'\n            - '\\osbaseln.dll'\n            - '\\osksupport.dll'\n            - '\\osuninst.dll'\n            - '\\p2p.dll'\n            - '\\p2pnetsh.dll'\n            - '\\p9np.dll'\n            - '\\pcaui.dll'\n            - '\\pdh.dll'\n            - '\\peerdistsh.dll'\n            - '\\pkeyhelper.dll'\n            - '\\pla.dll'\n            - '\\playsndsrv.dll'\n            - '\\pnrpnsp.dll'\n            - '\\policymanager.dll'\n            - '\\polstore.dll'\n            - '\\powrprof.dll'\n            - '\\printui.dll'\n            - '\\prntvpt.dll'\n            - '\\profapi.dll'\n            - '\\propsys.dll'\n            - '\\proximitycommon.dll'\n            - '\\proximityservicepal.dll'\n            - '\\prvdmofcomp.dll'\n            - '\\puiapi.dll'\n            - '\\radcui.dll'\n            - '\\rasapi32.dll'\n            - '\\rasdlg.dll'\n            - '\\rasgcw.dll'\n            - '\\rasman.dll'\n            - '\\rasmontr.dll'\n            - '\\reagent.dll'\n            - '\\regapi.dll'\n            - '\\reseteng.dll'\n            - '\\resetengine.dll'\n            - '\\resutils.dll'\n            - '\\rmclient.dll'\n            - '\\rpcnsh.dll'\n            - '\\rsaenh.dll'\n            - '\\rtutils.dll'\n            - '\\rtworkq.dll'\n            - '\\samcli.dll'\n            - '\\samlib.dll'\n            - '\\sapi_onecore.dll'\n            - '\\sas.dll'\n            - '\\scansetting.dll'\n            - '\\scecli.dll'\n            - '\\schedcli.dll'\n            - '\\secur32.dll'\n            - '\\security.dll'\n            - '\\sensapi.dll'\n            - '\\shell32.dll'\n            - '\\shfolder.dll'\n            - '\\slc.dll'\n            - '\\snmpapi.dll'\n            - '\\spectrumsyncclient.dll'\n            - '\\spp.dll'\n            - '\\sppc.dll'\n            - '\\sppcext.dll'\n            - '\\srclient.dll'\n            - '\\srcore.dll'\n            - '\\srmtrace.dll'\n            - '\\srpapi.dll'\n            - '\\srvcli.dll'\n            - '\\ssp_isv.exe_rsaenh.dll'\n            - '\\ssp.exe_rsaenh.dll'\n            - '\\sspicli.dll'\n            - '\\ssshim.dll'\n            - '\\staterepository.core.dll'\n            - '\\structuredquery.dll'\n            - '\\sxshared.dll'\n            - '\\systemsettingsthresholdadminflowui.dll'\n            - '\\tapi32.dll'\n            - '\\tbs.dll'\n            - '\\tdh.dll'\n            - '\\textshaping.dll'\n            - '\\timesync.dll'\n            - '\\tpmcoreprovisioning.dll'\n            - '\\tquery.dll'\n            - '\\tsworkspace.dll'\n            - '\\ttdrecord.dll'\n            - '\\twext.dll'\n            - '\\twinapi.dll'\n            - '\\twinui.appcore.dll'\n            - '\\uianimation.dll'\n            - '\\uiautomationcore.dll'\n            - '\\uireng.dll'\n            - '\\uiribbon.dll'\n            - '\\umpdc.dll'\n            - '\\unattend.dll'\n            - '\\updatepolicy.dll'\n            - '\\upshared.dll'\n            - '\\urlmon.dll'\n            - '\\userenv.dll'\n            - '\\utildll.dll'\n            - '\\uxinit.dll'\n            - '\\uxtheme.dll'\n            - '\\vaultcli.dll'\n            - '\\vdsutil.dll'\n            - '\\version.dll'\n            - '\\virtdisk.dll'\n            - '\\vssapi.dll'\n            - '\\vsstrace.dll'\n            - '\\wbemprox.dll'\n            - '\\wbemsvc.dll'\n            - '\\wcmapi.dll'\n            - '\\wcnnetsh.dll'\n            - '\\wdi.dll'\n            - '\\wdscore.dll'\n            - '\\webservices.dll'\n            - '\\wecapi.dll'\n            - '\\wer.dll'\n            - '\\wevtapi.dll'\n            - '\\whhelper.dll'\n            - '\\wimgapi.dll'\n            - '\\winbio.dll'\n            - '\\winbrand.dll'\n            - '\\windows.storage.dll'\n            - '\\windows.storage.search.dll'\n            - '\\windows.ui.immersive.dll'\n            - '\\windowscodecs.dll'\n            - '\\windowscodecsext.dll'\n            - '\\windowsudk.shellcommon.dll'\n            - '\\winhttp.dll'\n            - '\\wininet.dll'\n            - '\\winipsec.dll'\n            - '\\winmde.dll'\n            - '\\winmm.dll'\n            - '\\winnsi.dll'\n            - '\\winrnr.dll'\n            - '\\winscard.dll'\n            - '\\winsqlite3.dll'\n            - '\\winsta.dll'\n            - '\\winsync.dll'\n            - '\\wkscli.dll'\n            - '\\wlanapi.dll'\n            - '\\wlancfg.dll'\n            - '\\wldp.dll'\n            - '\\wlidprov.dll'\n            - '\\wmiclnt.dll'\n            - '\\wmidcom.dll'\n            - '\\wmiutils.dll'\n            - '\\wmpdui.dll'\n            - '\\wmsgapi.dll'\n            - '\\wofutil.dll'\n            - '\\wpdshext.dll'\n            - '\\wscapi.dll'\n            - '\\wsdapi.dll'\n            - '\\wshbth.dll'\n            - '\\wshelper.dll'\n            - '\\wsmsvc.dll'\n            - '\\wtsapi32.dll'\n            - '\\wwancfg.dll'\n            - '\\wwapi.dll'\n            - '\\xmllite.dll'\n            - '\\xolehlp.dll'\n            - '\\xpsservices.dll'\n            - '\\xwizards.dll'\n            - '\\xwtpw32.dll'\n            # From https://github.com/XForceIR/SideLoadHunter/blob/main/SideLoads/README.md\n            - '\\amsi.dll'\n            - '\\appraiser.dll'\n            - '\\COMRES.DLL'\n            - '\\cryptnet.dll'\n            - '\\DispBroker.dll'\n            - '\\dsound.dll'\n            - '\\dxilconv.dll'\n            - '\\FxsCompose.dll'\n            - '\\FXSRESM.DLL'\n            - '\\msdtcVSp1res.dll'\n            - '\\PrintIsolationProxy.dll'\n            - '\\rdpendp.dll'\n            - '\\rpchttp.dll'\n            - '\\storageusage.dll'\n            - '\\utcutil.dll'\n            - '\\WfsR.dll'\n            # The DLLs below exists in \"C:\\Windows\\System32\\DriverStore\\FileRepository\\\" folder. But there is also a copy located in \"C:\\ProgramData\\Package Cache\\XXXXXXX\\Graphics\\\". If you see them being loaded from there. Please comment them out, don't add a filter for ProgramData :)\n            - '\\igd10iumd64.dll'\n            - '\\igd12umd64.dll'\n            - '\\igdumdim64.dll'\n            - '\\igdusc64.dll'\n            # Other\n            - '\\TSMSISrv.dll'\n            - '\\TSVIPSrv.dll'\n            - '\\wbemcomn.dll'\n            - '\\WLBSCTRL.dll'\n            - '\\wow64log.dll'\n            - '\\WptsExtensions.dll'\n    filter_main_generic:\n        # Note: this filter is generic on purpose to avoid insane amount of FP from legitimate third party applications. A better approach would be to baseline everything and add specific filters to avoid blind spots\n        ImageLoaded|contains:\n            - 'C:\\$WINDOWS.~BT\\'\n            - 'C:\\$WinREAgent\\'\n            - 'C:\\Windows\\SoftwareDistribution\\'\n            - 'C:\\Windows\\System32\\'\n            - 'C:\\Windows\\SystemTemp\\'\n            - 'C:\\Windows\\SysWOW64\\'\n            - 'C:\\Windows\\WinSxS\\'\n            - 'C:\\Windows\\SyChpe32\\' # “hybrid” binaries containing x86-to-ARM stubs to improve the x86 emulation performance\n    filter_main_windows_temp:\n        ImageLoaded|startswith: 'C:\\Windows\\Temp\\'\n        Image|startswith:\n            - 'C:\\Windows\\WinSxS\\arm64'\n            - 'C:\\Windows\\UUS\\arm64\\'\n        Image|endswith:\n            - '\\TiWorker.exe'\n            - '\\wuaucltcore.exe'\n    filter_main_dot_net:\n        ImageLoaded|startswith: 'C:\\Windows\\Microsoft.NET\\'\n        ImageLoaded|endswith: '\\cscui.dll'\n    filter_main_defender:\n        ImageLoaded|startswith: 'C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_main_directx:\n        ImageLoaded|startswith: 'C:\\Program Files\\WindowsApps\\Microsoft.DirectXRuntime_'\n        ImageLoaded|endswith: '\\d3dx9_43.dll'\n    filter_optional_exchange:\n        ImageLoaded|startswith: 'C:\\Program Files\\Microsoft\\Exchange Server\\'\n        ImageLoaded|endswith: '\\mswb7.dll'\n    filter_optional_arsenal_image_mounter:\n        ImageLoaded|startswith: 'C:\\Program Files\\Arsenal-Image-Mounter-'\n        ImageLoaded|endswith:\n            - '\\mi.dll'\n            - '\\miutils.dl'\n    filter_optional_office_appvpolicy:\n        Image: 'C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe'\n        ImageLoaded: 'C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll'\n    filter_optional_azure:\n        ImageLoaded|startswith: 'C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\'\n    filter_optional_dell:\n        Image|contains:\n            - 'C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs'\n            - 'C:\\Windows\\System32\\backgroundTaskHost.exe'\n        ImageLoaded|startswith: 'C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs'\n    filter_optional_dell_wldp:\n        Image|startswith: 'C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs'\n        Image|endswith: '\\wldp.dll'\n    filter_optional_checkpoint:\n        Image|startswith:\n            - 'C:\\Program Files\\CheckPoint\\'\n            - 'C:\\Program Files (x86)\\CheckPoint\\'\n        Image|endswith: '\\SmartConsole.exe'\n        ImageLoaded|startswith:\n            - 'C:\\Program Files\\CheckPoint\\'\n            - 'C:\\Program Files (x86)\\CheckPoint\\'\n        ImageLoaded|endswith: '\\PolicyManager.dll'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate applications loading their own versions of the DLLs mentioned in this rule\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/4fc0deee-0057-4998-ab31-d24e46e0aba4.json","kind":"sigma"}