Query: write Sigma for Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library. Threat actors have been observed us
Matching passage: Sigma rule: Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library. Threat actors have been observed us. Logsource: windows / image_load. Rule: title: Potential Vcruntime140 DLL Sideloading id: d7a63acb-1284-49bc-bfea-7771146c8b1c status: experimental description: 'Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library. Threat actors have been observed using DLL sideloading techniques to load malicious payloads under the guise of legitimate applications such as SqlWriter, SqlDumper etc. Notably, APT29 has been documented leveraging WinELOADER to sideload vcruntime140.dll for executing malicious code. ' references: - https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties - https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader - https://www.nextron-systems.com/2023/09/15/detecting-janelarat-with-yara-and-thor/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-12 modified: 2026-05-18 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vcruntime140.dll filter_main_legitimate_path: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Program Files\ - C:\Program Files (x86)\ filter_main_legitimate_signer: Signed: true SignatureStatus: Valid Description|endswith: C Runtime Library filter_optional_onedrive: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\OneDrive\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/image_load/image_load_side_load_vcruntime140/info.yml
Near-miss passage: Sigma rule: Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. The. Logsource: windows / file_event. Rule: title: Registry Hive File Staged Outside Standard User Profile Path id: a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73 status: experimental description: 'Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. These files generally contain various user-specific registry settings and are typically located in the user''s profile directory. Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings for persistence, privilege escalation, or dump user registry hives for credential harvesting. ' references: - https://github.com/MSNightmare/LegacyHive - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.t1548 - attack.credential-access - attack.t1003 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \UsrClass.dat - \NTUSER.DAT filter_main_usrclass: TargetFilename|endswith: \AppData\Local\Microsoft\Windows\UsrClass.dat filter_main_ntuser: TargetFilename|re|i: ^C:\\Users\\[^\\]+\\NTUSER\.DAT$ filter_main_system: TargetFilename|startswith: - C:\Windows\System32\config\ - C:\Windows\SYSVOL\ - C:\Windows\ServiceProfiles\ condition: selection and not 1 of filter_main_* falsepositives: - Backup or profile migration software - Forensic acquisition tools level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation/info.yml