Query: alert when Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc
Matching passage: Sigma rule: Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc. Logsource: windows / image_load. Rule: title: Potential Antivirus Software DLL Sideloading id: 552b6b65-df37-4d3e-a258-f2fc4771ae54 status: test description: Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_bitdefender: ImageLoaded|endswith: \log.dll filter_log_dll_bitdefender: ImageLoaded|startswith: - C:\Program Files\Bitdefender Antivirus Free\ - C:\Program Files (x86)\Bitdefender Antivirus Free\ filter_log_dll_dell_sar: Image: C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe ImageLoaded: - C:\Program Files\Dell\SARemediation\plugin\log.dll - C:\Program Files\Dell\SARemediation\audit\log.dll filter_log_dll_canon: ImageLoaded|startswith: C:\Program Files\Canon\MyPrinter\ filter_log_dll_avast: ImageLoaded: - C:\Program Files\AVAST Software\Avast\log.dll - C:\Program Files (x86)\AVAST Software\Avast\log.dll filter_log_dll_avg: ImageLoaded: - C:\Program Files\AVG\Antivirus\log.dll - C:\Program Files (x86)\AVG\Antivirus\log.dll selection_fsecure: ImageLoaded|endswith: \qrt.dll filter_fsecure: ImageLoaded|startswith: - C:\Program Files\F-Secure\Anti-Virus\ - C:\Program Files (x86)\F-Secure\Anti-Virus\ selection_mcafee: ImageLoaded|endswith: - \ashldres.dll - \lockdown.dll - \vsodscpl.dll filter_mcafee: ImageLoaded|startswith: - C:\Program Files\McAfee\ - C:\Program Files (x86)\McAfee\ selection_cyberark: ImageLoaded|endswith: \vftrace.dll filter_cyberark: ImageLoaded|startswith: - C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\ - C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32\ selection_avast: ImageLoaded|endswith: \wsc.dll filter_wsc_dll_avast: ImageLoaded|startswith: - C:\program Files\AVAST Software\Avast\ - C:\program Files (x86)\AVAST Software\Avast\ filter_wsc_dll_avg: ImageLoaded|startswith: - C:\Program Files\AVG\Antivirus\ - C:\Program Files (x86)\AVG\Antivirus\ selection_eset_deslock: ImageLoaded|endswith: \DLPPREM32.dll filter_eset_deslock: ImageLoaded|startswith: - C:\program Files\ESET - C:\program Files (x86)\ESET selection_titanium: ImageLoaded|endswith: \tmdbglog.dll filter_titanium: ImageLoaded|startswith: - C:\program Files\Trend
Near-miss passage: Sigma rule: Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in com. Logsource: windows / image_load. Rule: title: DLL Sideloading Of ShellChromeAPI.DLL id: ee4c5d06-3abc-48cc-8885-77f1c20f4451 related: - id: e173ad47-4388-4012-ae62-bd13f71c18a8 type: similar status: test description: 'Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter ' references: - https://mobile.twitter.com/0gtweet/status/1564131230941122561 - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \ShellChromeAPI.dll condition: selection falsepositives: - Unknown level: high