{"id":"b5de0c9a-6f19-43e0-af4e-55ad01f550af","title":"Unsigned DLL Loaded by Windows Utility","description":"Detects windows utilities loading an unsigned or untrusted DLL.\nAdversaries often abuse those programs to proxy execution of malicious code.\n","author":"Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2024-02-28","modified":"2025-10-07","tags":["attack.stealth","attack.t1218.011","attack.t1218.010"],"technique_ids":["T1218.010","T1218.011"],"logsource":{"product":"windows","category":"image_load"},"falsepositives":["Unknown"],"references":["https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion","https://akhere.hashnode.dev/hunting-unsigned-dlls-using-kql","https://unit42.paloaltonetworks.com/unsigned-dlls/?web_view=true"],"source_path":"rules/windows/image_load/image_load_susp_unsigned_dll.yml","source_sha256":"f54ed399511474f551543e98ee2383f646761f1323413ea753624d0d01ff125b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_susp_unsigned_dll.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Unsigned DLL Loaded by Windows Utility\nid: b5de0c9a-6f19-43e0-af4e-55ad01f550af\nstatus: test\ndescription: |\n    Detects windows utilities loading an unsigned or untrusted DLL.\n    Adversaries often abuse those programs to proxy execution of malicious code.\nreferences:\n    - https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion\n    - https://akhere.hashnode.dev/hunting-unsigned-dlls-using-kql\n    - https://unit42.paloaltonetworks.com/unsigned-dlls/?web_view=true\nauthor: Swachchhanda Shrawan Poudel\ndate: 2024-02-28\nmodified: 2025-10-07\ntags:\n    - attack.stealth\n    - attack.t1218.011\n    - attack.t1218.010\nlogsource:\n    product: windows\n    category: image_load\ndetection:\n    selection:\n        Image|endswith:\n            # Note: Add additional utilities that allow the loading of DLLs\n            - '\\InstallUtil.exe'\n            - '\\RegAsm.exe'\n            - '\\RegSvcs.exe'\n            - '\\regsvr32.exe'\n            - '\\rundll32.exe'\n    filter_main_signed:\n        Signed: 'true'\n    filter_main_sig_status:\n        SignatureStatus:\n            - 'errorChaining'\n            - 'errorCode_endpoint'\n            - 'errorExpired'\n            - 'trusted'\n            - 'Valid'\n    filter_main_signed_null:\n        Signed: null\n    filter_main_signed_empty:\n        Signed:\n            - ''\n            - '-'\n    filter_main_sig_status_null:\n        SignatureStatus: null\n    filter_main_sig_status_empty:\n        SignatureStatus:\n            - ''\n            - '-'\n    filter_main_windows_installer:\n        Image:\n            - 'C:\\Windows\\SysWOW64\\rundll32.exe'\n            - 'C:\\Windows\\System32\\rundll32.exe'\n        ImageLoaded|startswith: 'C:\\Windows\\Installer\\'\n        ImageLoaded|endswith:\n            - '.tmp-\\Microsoft.Deployment.WindowsInstaller.dll'\n            - '.tmp-\\Avira.OE.Setup.CustomActions.dll'\n    filter_main_assembly:\n        Image|startswith:\n            - 'C:\\Windows\\SysWOW64\\'\n            - 'C:\\Windows\\System32\\'\n            - 'C:\\Windows\\Microsoft.NET\\Framework64'\n        Image|endswith: '\\RegAsm.exe'\n        ImageLoaded|endswith: '.dll'\n        ImageLoaded|startswith: 'C:\\Windows\\assembly\\NativeImages'\n    filter_optional_klite_codec:\n        Image:\n            - 'C:\\Windows\\SysWOW64\\regsvr32.exe'\n            - 'C:\\Windows\\System32\\regsvr32.exe'\n        ImageLoaded|startswith:\n            - 'C:\\Program Files (x86)\\K-Lite Codec Pack\\'\n            - 'C:\\Program Files\\K-Lite Codec Pack\\'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218.010","id":"T1218.010","name":"Regsvr32","page":"techniques/enterprise/T1218.010/"},{"key":"enterprise/T1218.011","id":"T1218.011","name":"Rundll32","page":"techniques/enterprise/T1218.011/"}],"data_path":"data/detection-rules/b5de0c9a-6f19-43e0-af4e-55ad01f550af.json","kind":"sigma"}