{"id":"7a3b6d1f-4a2b-4f8c-9d7e-e9f8cbf21a35","title":"Potential JLI.dll Side-Loading","description":"Detects potential DLL side-loading of jli.dll.\nJLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm,\nand others in order to load malicious payloads in context of legitimate Java processes.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-07-25","modified":"2025-10-06","tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.001"],"technique_ids":["T1574.001"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Unknown"],"references":["https://securelist.com/apt41-in-africa/116986/","https://lab52.io/blog/snake-keylogger-in-geopolitical-affairs-abuse-of-trusted-java-utilities-in-cybercrime-operations/","https://hijacklibs.net/entries/3rd_party/oracle/jli.html","https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting"],"source_path":"rules/windows/image_load/image_load_side_load_jli.yml","source_sha256":"4f9ebddc3598c23e2e50ddfb12a6564b8bc8e2a03af4e0b53bd7c18a23f0acf6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_side_load_jli.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential JLI.dll Side-Loading\nid: 7a3b6d1f-4a2b-4f8c-9d7e-e9f8cbf21a35\nstatus: experimental\ndescription: |\n    Detects potential DLL side-loading of jli.dll.\n    JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm,\n    and others in order to load malicious payloads in context of legitimate Java processes.\nreferences:\n    - https://securelist.com/apt41-in-africa/116986/\n    - https://lab52.io/blog/snake-keylogger-in-geopolitical-affairs-abuse-of-trusted-java-utilities-in-cybercrime-operations/\n    - https://hijacklibs.net/entries/3rd_party/oracle/jli.html\n    - https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-07-25\nmodified: 2025-10-06\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.001\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        ImageLoaded|endswith: '\\jli.dll'\n    filter_main_legitimate_install_paths:\n        ImageLoaded|startswith:\n            # Keeping the paths generic as jli.dll was found inside various directories of installed software\n            - 'C:\\Program Files\\'\n            - 'C:\\Program Files (x86)\\'\n        Description: 'OpenJDK Platform binary'\n        OriginalFileName: 'jli.dll'\n        Product|startswith: 'OpenJDK Platform'\n        Signed: 'true'\n    filter_optional_eclipse:\n        ImageLoaded|startswith: 'C:\\eclipse\\plugins\\'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/7a3b6d1f-4a2b-4f8c-9d7e-e9f8cbf21a35.json","kind":"sigma"}