Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy executio. Logsource: windows / image_load. Rule: title: Unsigned DLL Loaded by Windows Utility id: b5de0c9a-6f19-43e0-af4e-55ad01f550af status: test description: 'Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy execution of malicious code. ' references: - https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion - https://akhere.hashnode.dev/hunting-unsigned-dlls-using-kql - https://unit42.paloaltonetworks.com/unsigned-dlls/?web_view=true author: Swachchhanda Shrawan Poudel date: 2024-02-28 modified: 2025-10-07 tags: - attack.stealth - attack.t1218.011 - attack.t1218.010 logsource: product: windows category: image_load detection: selection: Image|endswith: - \InstallUtil.exe - \RegAsm.exe - \RegSvcs.exe - \regsvr32.exe - \rundll32.exe filter_main_signed: Signed: 'true' filter_main_sig_status: SignatureStatus: - errorChaining - errorCode_endpoint - errorExpired - trusted - Valid filter_main_signed_null: Signed: null filter_main_signed_empty: Signed: - '' - '-' filter_main_sig_status_null: SignatureStatus: null filter_main_sig_status_empty: SignatureStatus: - '' - '-' filter_main_windows_installer: Image: - C:\Windows\SysWOW64\rundll32.exe - C:\Windows\System32\rundll32.exe ImageLoaded|startswith: C:\Windows\Installer\ ImageLoaded|endswith: - .tmp-\Microsoft.Deployment.WindowsInstaller.dll - .tmp-\Avira.OE.Setup.CustomActions.dll filter_main_assembly: Image|startswith: - C:\Windows\SysWOW64\ - C:\Windows\System32\ - C:\Windows\Microsoft.NET\Framework64 Image|endswith: \RegAsm.exe ImageLoaded|endswith: .dll ImageLoaded|startswith: C:\Windows\assembly\NativeImages filter_optional_klite_codec: Image: - C:\Windows\SysWOW64\regsvr32.exe - C:\Windows\System32\regsvr32.exe ImageLoaded|startswith: - C:\Program Files (x86)\K-Lite Codec Pack\ - C:\Program Files\K-Lite Codec Pack\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID. Logsource: windows / process_creation. Rule: title: Potential COM Objects Download Cradles Usage - Process Creation id: 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf related: - id: 3c7d1587-3b13-439f-9941-7d14313dbdfe type: similar status: test description: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID references: - https://learn.microsoft.com/en-us/dotnet/api/system.type.gettypefromclsid?view=net-7.0 - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=57 author: frack113 date: 2022-12-25 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: process_creation detection: selection_1: CommandLine|contains: '[Type]::GetTypeFromCLSID(' selection_2: CommandLine|contains: - 0002DF01-0000-0000-C000-000000000046 - F6D90F16-9C73-11D3-B32E-00C04F990BB4 - F5078F35-C551-11D3-89B9-0000F81FE221 - 88d96a0a-f192-11d4-a65f-0040963251e5 - AFBA6B42-5692-48EA-8141-DC517DCF0EF1 - AFB40FFD-B609-40A3-9828-F88BBE11E4E3 - 88d96a0b-f192-11d4-a65f-0040963251e5 - 2087c2f4-2cef-4953-a8ab-66779b670495 - 000209FF-0000-0000-C000-000000000046 - 00024500-0000-0000-C000-000000000046 condition: all of selection_* falsepositives: - Legitimate use of the library level: medium