Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/writ. Logsource: windows / image_load. Rule: title: Potentially Suspicious Image Load of Offreg.dll id: c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95 status: experimental description: 'Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API, bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives while evading detection mechanisms that rely on standard registry event logs. ' references: - https://learn.microsoft.com/en-us/windows/win32/devnotes/about-the-offline-registry-library - https://github.com/MSNightmare/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.defense-impairment - attack.persistence - attack.t1112 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \offreg.dll filter_main_system32: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_program_files: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_appdata_local_programs: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Programs\ filter_main_defender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* falsepositives: - Third-party backup or forensic software that performs offline registry parsing - Windows deployment tools (DISM, ADK) run from non-standard paths level: medium regression_tests_path: regression_data/rules/windows/image_load/image_load_susp_offreg_dll_load/info.yml
Near-miss passage: Sigma rule: Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various. Logsource: windows / image_load. Rule: title: Potential JLI.dll Side-Loading id: 7a3b6d1f-4a2b-4f8c-9d7e-e9f8cbf21a35 status: experimental description: 'Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes. ' references: - https://securelist.com/apt41-in-africa/116986/ - https://lab52.io/blog/snake-keylogger-in-geopolitical-affairs-abuse-of-trusted-java-utilities-in-cybercrime-operations/ - https://hijacklibs.net/entries/3rd_party/oracle/jli.html - https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-25 modified: 2025-10-06 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \jli.dll filter_main_legitimate_install_paths: ImageLoaded|startswith: - C:\Program Files\ - C:\Program Files (x86)\ Description: OpenJDK Platform binary OriginalFileName: jli.dll Product|startswith: OpenJDK Platform Signed: 'true' filter_optional_eclipse: ImageLoaded|startswith: C:\eclipse\plugins\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high