Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe. Logsource: windows / image_load. Rule: title: Potential Goopdate.DLL Sideloading id: b6188d2f-b3c4-4d2c-a17d-9706e0851af0 status: test description: Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe references: - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \goopdate.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ filter_optional_dropbox_installer_temp: Image|contains|all: - \AppData\Local\Temp\GUM - .tmp\Dropbox ImageLoaded|contains|all: - \AppData\Local\Temp\GUM - .tmp\goopdate.dll filter_optional_googleupdate_temp: Image|contains: - \AppData\Local\Temp\GUM - :\Windows\SystemTemp\GUM Image|endswith: .tmp\GoogleUpdate.exe ImageLoaded|contains: - \AppData\Local\Temp\GUM - :\Windows\SystemTemp\GUM condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - False positives are expected from Google Chrome installations running from user locations (AppData) and other custom locations. Apply additional filters accordingly. - Other third party chromium browsers located in AppData level: medium
Near-miss passage: Sigma rule: Detects uncommon processes creating remote threads.. Logsource: windows / create_remote_thread. Rule: title: Rare Remote Thread Creation By Uncommon Source Image id: 02d1d718-dd13-41af-989d-ea85c7fab93f related: - id: 66d31e5f-52d6-40a4-9615-002d3789a119 type: derived status: test description: Detects uncommon processes creating remote threads. references: - Personal research, statistical analysis - https://lolbas-project.github.io author: Perez Diego (@darkquassar), oscd.community date: 2019-10-27 modified: 2025-12-08 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \bash.exe - \cscript.exe - \cvtres.exe - \defrag.exe - \dialer.exe - \dnx.exe - \esentutl.exe - \excel.exe - \expand.exe - \find.exe - \findstr.exe - \forfiles.exe - \gpupdate.exe - \hh.exe - \installutil.exe - \lync.exe - \makecab.exe - \mDNSResponder.exe - \monitoringhost.exe - \msbuild.exe - \mshta.exe - \mspaint.exe - \outlook.exe - \ping.exe - \provtool.exe - \python.exe - \regsvr32.exe - \robocopy.exe - \runonce.exe - \sapcimc.exe - \smartscreen.exe - \spoolsv.exe - \tstheme.exe - \userinit.exe - \vssadmin.exe - \vssvc.exe - \w3wp.exe - \winscp.exe - \winword.exe - \wmic.exe - \wscript.exe filter_main_conhost: SourceImage: - C:\Windows\System32\Defrag.exe - C:\Windows\System32\makecab.exe TargetImage: C:\Windows\System32\conhost.exe filter_main_provtol_svchost: SourceImage: C:\Windows\System32\provtool.exe TargetImage: C:\Windows\System32\svchost.exe filter_main_provtool_system: SourceImage: C:\Windows\System32\provtool.exe TargetImage: System filter_main_userinit: SourceImage: C:\Windows\System32\userinit.exe TargetImage: C:\Windows\explorer.exe filter_main_winword: SourceImage|endswith: \WINWORD.EXE TargetImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ filter_main_ms_office: SourceImage|startswith: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ TargetImage: System filter_optional_explorer_vmtools: SourceImage|endswith: \SysWOW64\explorer.exe TargetImage: - C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe - C:\Program Files\VMware\VMware Tools\vmtoolsd.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - This rule is best put in testing first in order to create a baseline that reflects the data in your environment. level: high