Potential JLI.dll Side-Loading — Sigma Rule

Rule metadata and linked tags

Author: Swachchhanda Shrawan Poudel (Nextron Systems). Source status: experimental; severity: high. Source dates: 2025-07-25 / 2025-10-06.

{
  "category": "image_load",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 4f9ebddc3598c23e2e50ddfb12a6564b8bc8e2a03af4e0b53bd7c18a23f0acf6

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Potential JLI.dll Side-Loading
id: 7a3b6d1f-4a2b-4f8c-9d7e-e9f8cbf21a35
status: experimental
description: |
    Detects potential DLL side-loading of jli.dll.
    JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm,
    and others in order to load malicious payloads in context of legitimate Java processes.
references:
    - https://securelist.com/apt41-in-africa/116986/
    - https://lab52.io/blog/snake-keylogger-in-geopolitical-affairs-abuse-of-trusted-java-utilities-in-cybercrime-operations/
    - https://hijacklibs.net/entries/3rd_party/oracle/jli.html
    - https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-07-25
modified: 2025-10-06
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\jli.dll'
    filter_main_legitimate_install_paths:
        ImageLoaded|startswith:
            # Keeping the paths generic as jli.dll was found inside various directories of installed software
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
        Description: 'OpenJDK Platform binary'
        OriginalFileName: 'jli.dll'
        Product|startswith: 'OpenJDK Platform'
        Signed: 'true'
    filter_optional_eclipse:
        ImageLoaded|startswith: 'C:\eclipse\plugins\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: high

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://securelist.com/apt41-in-africa/116986/
• https://lab52.io/blog/snake-keylogger-in-geopolitical-affairs-abuse-of-trusted-java-utilities-in-cybercrime-operations/
• https://hijacklibs.net/entries/3rd_party/oracle/jli.html
• https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting