Query: Sigma rule for Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).
Matching passage: Sigma rule: Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).. Logsource: windows / image_load. Rule: title: Potential System DLL Sideloading From Non System Locations id: 4fc0deee-0057-4998-ab31-d24e46e0aba4 status: test description: Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.). references: - https://hijacklibs.net/ - https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/ - https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/ - https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md - https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ - https://www.sophos.com/en-us/blog/finding-minhook-in-a-sideloading-attack-and-sweden-too author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2026-07-10 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \aclui.dll - \activeds.dll - \adsldpc.dll - \aepic.dll - \apphelp.dll - \applicationframe.dll - \appvpolicy.dll - \appxalluserstore.dll - \appxdeploymentclient.dll - \archiveint.dll - \atl.dll - \audioses.dll - \auditpolcore.dll - \authfwcfg.dll - \authz.dll - \avrt.dll - \batmeter.dll - \bcd.dll - \bcp47langs.dll - \bcp47mrm.dll - \bcrypt.dll - \bderepair.dll - \bootmenuux.dll - \bootux.dll - \cabinet.dll - \cabview.dll - \certcli.dll - \certenroll.dll - \cfgmgr32.dll - \cldapi.dll - \clipc.dll - \clusapi.dll - \cmpbk32.dll - \cmutil.dll - \coloradapterclient.dll - \colorui.dll - \comdlg32.dll - \configmanager2.dll - \connect.dll - \coredplus.dll - \coremessaging.dll - \coreuicomponents.dll - \credui.dll - \cryptbase.dll - \cryptdll.dll - \cryptsp.dll - \cryptui.dll - \cryptxml.dll - \cscapi.dll - \cscobj.dll - \cscui.dll - \d2d1.dll - \d3d10_1.dll - \d3d10_1core.dll - \d3d10.dll - \d3d10core.dll - \d3d10warp.dll - \d3d11.dll - \d3d12.dll - \d3d9.dll - \d3dx9_43.dll - \dataexchange.dll - \davclnt.dll - \dcntel.dll - \dcomp.dll - \defragproxy.dll - \desktopshellext.dll - \deviceassociation.dll - \devicecredential.dll - \devicepairing.dll - \devobj.dll - \devrtl.dll - \dhcpcmonitor.dll - \dhcpcsvc.dll - \dhcpcsvc6.dll - \directmanipulation.dll - \dismapi.dll - \dismcore.dll - \dmcfgutils.dll - \dmcmnutils.dll - \dmcommandlineutils.dll - \dmenrollengine.dll - \dmenterprisediagnostics.dll - \dmiso8601utils.dll - \dmoleaututils.dll - \dmprocessxmlfiltered.dll - \
Near-miss passage: Sigma rule: Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This techni. Logsource: windows / registry_set. Rule: title: Potential EventLog File Location Tampering id: 0cb8d736-995d-4ce7-a31e-1e8d452a1459 status: test description: Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting references: - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key author: D3F7A5105 date: 2023-01-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\ TargetObject|endswith: \File filter: Details|contains: \System32\Winevt\Logs\ condition: selection and not filter falsepositives: - Unknown level: high