Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).. Logsource: windows / image_load. Rule: title: Potential System DLL Sideloading From Non System Locations id: 4fc0deee-0057-4998-ab31-d24e46e0aba4 status: test description: Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.). references: - https://hijacklibs.net/ - https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/ - https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/ - https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md - https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ - https://www.sophos.com/en-us/blog/finding-minhook-in-a-sideloading-attack-and-sweden-too author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2026-07-10 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \aclui.dll - \activeds.dll - \adsldpc.dll - \aepic.dll - \apphelp.dll - \applicationframe.dll - \appvpolicy.dll - \appxalluserstore.dll - \appxdeploymentclient.dll - \archiveint.dll - \atl.dll - \audioses.dll - \auditpolcore.dll - \authfwcfg.dll - \authz.dll - \avrt.dll - \batmeter.dll - \bcd.dll - \bcp47langs.dll - \bcp47mrm.dll - \bcrypt.dll - \bderepair.dll - \bootmenuux.dll - \bootux.dll - \cabinet.dll - \cabview.dll - \certcli.dll - \certenroll.dll - \cfgmgr32.dll - \cldapi.dll - \clipc.dll - \clusapi.dll - \cmpbk32.dll - \cmutil.dll - \coloradapterclient.dll - \colorui.dll - \comdlg32.dll - \configmanager2.dll - \connect.dll - \coredplus.dll - \coremessaging.dll - \coreuicomponents.dll - \credui.dll - \cryptbase.dll - \cryptdll.dll - \cryptsp.dll - \cryptui.dll - \cryptxml.dll - \cscapi.dll - \cscobj.dll - \cscui.dll - \d2d1.dll - \d3d10_1.dll - \d3d10_1core.dll - \d3d10.dll - \d3d10core.dll - \d3d10warp.dll - \d3d11.dll - \d3d12.dll - \d3d9.dll - \d3dx9_43.dll - \dataexchange.dll - \davclnt.dll - \dcntel.dll - \dcomp.dll - \defragproxy.dll - \desktopshellext.dll - \deviceassociation.dll - \devicecredential.dll - \devicepairing.dll - \devobj.dll - \devrtl.dll - \dhcpcmonitor.dll - \dhcpcsvc.dll - \dhcpcsvc6.dll - \directmanipulation.dll - \dismapi.dll - \dismcore.dll - \dmcfgutils.dll - \dmcmnutils.dll - \dmcommandlineutils.dll - \dmenrollengine.dll - \dmenterprisediagnostics.dll - \dmiso8601utils.dll - \dmoleaututils.dll - \dmprocessxmlfiltered.dll - \
Near-miss passage: Sigma rule: Sysmon registry detection of a local hidden user account.. Logsource: windows / registry_event. Rule: title: Creation of a Local Hidden User Account by Registry id: 460479f3-80b7-42da-9c43-2cc1d54dbccd status: test description: Sysmon registry detection of a local hidden user account. references: - https://twitter.com/SBousseaden/status/1387530414185664538 author: Christian Burkard (Nextron Systems) date: 2021-05-03 modified: 2025-10-31 tags: - attack.persistence - attack.t1136.001 logsource: product: windows category: registry_event detection: selection: TargetObject|contains: \SAM\SAM\Domains\Account\Users\Names\ TargetObject|endswith: $\(Default) Image|endswith: \lsass.exe condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_event/registry_event_add_local_hidden_user/info.yml simulation: - type: atomic-red-team name: Create Hidden User in Registry technique: T1564.002 atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c