Query: Sigma rule for Detects loading of specific system DLL files that are usually not present on the system (or at least not in system direc
Matching passage: Sigma rule: Detects loading of specific system DLL files that are usually not present on the system (or at least not in system direc. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of Non-Existent DLLs From System Folders id: 6b98b92b-4f00-4f62-b4fe-4d1920215771 related: - id: df6ecb8b-7822-4f4b-b412-08f524b4576c type: similar - id: 602a1f13-c640-4d73-b053-be9a2fa58b77 type: obsolete status: test description: 'Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs. ' references: - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/ - https://decoded.avast.io/martinchlumecky/png-steganography/ - https://github.com/Wh04m1001/SysmonEoP - https://itm4n.github.io/cdpsvc-dll-hijacking/ - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992 - https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/ - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/ - https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/ - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/ - https://x.com/0gtweet/status/1564131230941122561 author: Nasreddine Bencherchali (Nextron Systems), SBousseaden date: 2022-12-09 modified: 2026-01-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - :\Windows\System32\axeonoffhelper.dll - :\Windows\System32\cdpsgshims.dll - :\Windows\System32\oci.dll - :\Windows\System32\offdmpsvc.dll - :\Windows\System32\shellchromeapi.dll - :\Windows\System32\TSMSISrv.dll - :\Windows\System32\TSVIPSrv.dll - :\Windows\System32\wbem\wbemcomn.dll - :\Windows\System32\WLBSCTRL.dll - :\Windows\System32\wow64log.dll - :\Windows\System32\WptsExtensions.dll filter_main_ms_signed: Signed: 'true' SignatureStatus: Valid Signature: Microsoft Windows condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation VAR+ Launcher - PowerShell Module id: 6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e related: - id: 0adfbc14-0ed1-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*" condition: selection_4103 falsepositives: - Unknown level: high