deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Goopdate.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\goopdate.dll"
  },
  "filter_main_generic": {
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\"
    ]
  },
  "filter_optional_dropbox_installer_temp": {
    "Image|contains|all": [
      "\\AppData\\Local\\Temp\\GUM",
      ".tmp\\Dropbox"
    ],
    "ImageLoaded|contains|all": [
      "\\AppData\\Local\\Temp\\GUM",
      ".tmp\\goopdate.dll"
    ]
  },
  "filter_optional_googleupdate_temp": {
    "Image|contains": [
      "\\AppData\\Local\\Temp\\GUM",
      ":\\Windows\\SystemTemp\\GUM"
    ],
    "Image|endswith": ".tmp\\GoogleUpdate.exe",
    "ImageLoaded|contains": [
      "\\AppData\\Local\\Temp\\GUM",
      ":\\Windows\\SystemTemp\\GUM"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
Sigma Detection Rule: DLL Sideloading Of ShellChromeAPI.DLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-01
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL.
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter


Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\ShellChromeAPI.dll"
  },
  "condition": "selection"
}

References:
  - https://mobile.twitter.com/0gtweet/status/[PII_REDACTED]41122561
  - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html
Sigma Detection Rule: Potential Azure Browser SSO Abuse
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Den Iuzvyk
Date: 2020-07-15
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser.
An attacker can use this to authenticate to Azure AD in a browser as that user.


Detection logic:
{
  "selection": {
    "ImageLoaded": "C:\\Windows\\System32\\MicrosoftAccountTokenProvider.dll"
  },
  "filter_main_bgtaskhost": {
    "Image|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ],
    "Image|endswith": "\\BackgroundTaskHost.exe"
  },
  "filter_optional_devenv": {
    "Image|startswith": [
      "C:\\Program Files\\Microsoft Visual Studio\\",
      "C:\\Program Files (x86)\\Microsoft Visual Studio\\"
    ],
    "Image|endswith": "\\IDE\\devenv.exe"
  },
  "filter_optional_ie": {
    "Image": [
      "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "C:\\Program Files\\Internet Explorer\\iexplore.exe"
    ]
  },
  "filter_optional_edge_1": [
    {
      "Image|startswith": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\"
    },
    {
      "Image|endswith": "\\WindowsApps\\MicrosoftEdge.exe"
    },
    {
      "Image": [
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
        "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe"
      ]
    }
  ],
  "filter_optional_edge_2": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\Microsoft\\EdgeCore\\",
      "C:\\Program Files\\Microsoft\\EdgeCore\\"
    ],
    "Image|endswith": [
      "\\msedge.exe",
      "\\msedgewebview2.exe"
    ]
  },
  "filter_optional_onedrive": {
    "Image|endswith": "\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe"
  },
  "filter_optional_null": {
    "Image": null
  },
  "

References:
  - https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30
Sigma Detection Rule: CredUI.DLL Loaded By Uncommon Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-10-20
ATT&CK techniques: T1056.002
Log source: windows/image_load

Description:
Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

Detection logic:
{
  "selection": [
    {
      "ImageLoaded|endswith": [
        "\\credui.dll",
        "\\wincredui.dll"
      ]
    },
    {
      "OriginalFileName": [
        "credui.dll",
        "wincredui.dll"
      ]
    }
  ],
  "filter_main_generic": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\SystemApps\\"
    ]
  },
  "filter_main_full": {
    "Image": [
      "C:\\Windows\\explorer.exe",
      "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
      "C:\\Windows\\regedit.exe"
    ]
  },
  "filter_optional_opera": {
    "Image|endswith": "\\opera_autoupdate.exe"
  },
  "filter_optional_process_explorer": {
    "Image|endswith": [
      "\\procexp64.exe",
      "\\procexp.exe"
    ]
  },
  "filter_optional_teams": {
    "Image|startswith": "C:\\Users\\",
    "Image|contains": "\\AppData\\Local\\Microsoft\\Teams\\",
    "Image|endswith": "\\Teams.exe"
  },
  "filter_optional_onedrive": {
    "Image|startswith": "C:\\Users\\",
    "Image|contains": "\\AppData\\Local\\Microsoft\\OneDrive\\"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN[PII_REDACTED]08.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password
  - https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa
  - https://github.com/S12cybersecurity/RDPCredentialStealer
Sigma Detection Rule: Potential System DLL Sideloading From Non System Locations
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-14
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\aclui.dll",
      "\\activeds.dll",
      "\\adsldpc.dll",
      "\\aepic.dll",
      "\\apphelp.dll",
      "\\applicationframe.dll",
      "\\appvpolicy.dll",
      "\\appxalluserstore.dll",
      "\\appxdeploymentclient.dll",
      "\\archiveint.dll",
      "\\atl.dll",
      "\\audioses.dll",
      "\\auditpolcore.dll",
      "\\authfwcfg.dll",
      "\\authz.dll",
      "\\avrt.dll",
      "\\batmeter.dll",
      "\\bcd.dll",
      "\\bcp47langs.dll",
      "\\bcp47mrm.dll",
      "\\bcrypt.dll",
      "\\bderepair.dll",
      "\\bootmenuux.dll",
      "\\bootux.dll",
      "\\cabinet.dll",
      "\\cabview.dll",
      "\\certcli.dll",
      "\\certenroll.dll",
      "\\cfgmgr32.dll",
      "\\cldapi.dll",
      "\\clipc.dll",
      "\\clusapi.dll",
      "\\cmpbk32.dll",
      "\\cmutil.dll",
      "\\coloradapterclient.dll",
      "\\colorui.dll",
      "\\comdlg32.dll",
      "\\configmanager2.dll",
      "\\connect.dll",
      "\\coredplus.dll",
      "\\coremessaging.dll",
      "\\coreuicomponents.dll",
      "\\credui.dll",
      "\\cryptbase.dll",
      "\\cryptdll.dll",
      "\\cryptsp.dll",
      "\\cryptui.dll",
      "\\cryptxml.dll",
      "\\cscapi.dll",
      "\\cscobj.dll",
      "\\cscui.dll",
      "\\d2d1.dll",
      "\\d3d10_1.dll",
      "\\d3d10_1core.dll",
      "\\d3d10.dll",
      "\\d3d10core.dll",
      "\\d3d10warp.dll",
      "\\d3d11.dll",
      "\\d3d12.dll",
      "\\d3d9.dll",
   

References:
  - https://hijacklibs.net/
  - https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/
  - https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/
  - https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md
  - https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
Sigma Detection Rule: Wmiprvse Wbemcomn DLL Hijack
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-10-12
ATT&CK techniques: T1047, T1021.002
Log source: windows/image_load

Description:
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\wmiprvse.exe",
    "ImageLoaded|endswith": "\\wbem\\wbemcomn.dll"
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html
Sigma Detection Rule: Potential WWlib.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-05-18
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "wwlib.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\wwlib.dll"
  },
  "filter_main_path": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\Microsoft Office\\",
      "C:\\Program Files\\Microsoft Office\\"
    ],
    "Image|endswith": "\\winword.exe",
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\Microsoft Office\\",
      "C:\\Program Files\\Microsoft Office\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/WhichbufferArda/status/[PII_REDACTED]82774784
  - https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/
  - https://securelist.com/apt-luminousmoth/103332/
Sigma Detection Rule: Suspicious Volume Shadow Copy VSS_PS.dll Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis, @markus_neis
Date: 2021-07-07
ATT&CK techniques: T1490
Log source: windows/image_load

Description:
Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes.
It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.
The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.


Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\vss_ps.dll"
  },
  "filter_main_legit": {
    "Image|startswith": "C:\\Windows\\",
    "Image|endswith": [
      "\\clussvc.exe",
      "\\dismhost.exe",
      "\\dllhost.exe",
      "\\inetsrv\\appcmd.exe",
      "\\inetsrv\\iissetup.exe",
      "\\msiexec.exe",
      "\\rundll32.exe",
      "\\searchindexer.exe",
      "\\srtasks.exe",
      "\\svchost.exe",
      "\\System32\\SystemPropertiesAdvanced.exe",
      "\\taskhostw.exe",
      "\\thor.exe",
      "\\thor64.exe",
      "\\tiworker.exe",
      "\\vssvc.exe",
      "\\vssadmin.exe",
      "\\WmiPrvSE.exe",
      "\\wsmprovhost.exe"
    ]
  },
  "filter_main_update": {
    "CommandLine|startswith": "C:\\$WinREAgent\\Scratch\\",
    "CommandLine|contains": "\\dismhost.exe {"
  },
  "filter_main_image_null": {
    "Image": null
  },
  "filter_optional_programfiles": {
    "Image|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add
  - https://twitter.com/am0nsec/status/[PII_REDACTED]80982787
Sigma Detection Rule: Trusted Path Bypass via Windows Directory Spoofing
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-06-17
ATT&CK techniques: T1574.007, T1548.002
Log source: windows/image_load

Description:
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification.
This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.


Detection logic:
{
  "selection": {
    "ImageLoaded|contains": [
      ":\\Windows \\System32\\",
      ":\\Windows \\SysWOW64\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://x.com/Wietze/status/[PII_REDACTED]52421843
Sigma Detection Rule: VMGuestLib DLL Sideload
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-01
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

Detection logic:
{
  "selection": {
    "ImageLoaded|contains|all": [
      "\\VMware\\VMware Tools\\vmStatsProvider\\win32",
      "\\vmGuestLib.dll"
    ],
    "Image|endswith": "\\Windows\\System32\\wbem\\WmiApSrv.exe"
  },
  "filter": {
    "Signed": "true"
  },
  "condition": "selection and not filter"
}

References:
  - https://decoded.avast.io/martinchlumecky/png-steganography/
Sigma Detection Rule: VMMap Signed Dbghelp.DLL Potential Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-05
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

Detection logic:
{
  "selection": {
    "ImageLoaded|contains": "C:\\Debuggers\\dbghelp.dll",
    "Image|endswith": [
      "\\vmmap.exe",
      "\\vmmap64.exe"
    ],
    "Signed": "true"
  },
  "condition": "selection"
}

References:
  - https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v7-1-procdump-2-0-for-linux-process-explorer-v17-05/ba-p/3884766
Sigma Detection Rule: Unsigned DLL Loaded by Windows Utility
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-02-28
ATT&CK techniques: T1218.011, T1218.010
Log source: windows/image_load

Description:
Detects windows utilities loading an unsigned or untrusted DLL.
Adversaries often abuse those programs to proxy execution of malicious code.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\InstallUtil.exe",
      "\\RegAsm.exe",
      "\\RegSvcs.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe"
    ]
  },
  "filter_main_signed": {
    "Signed": "true"
  },
  "filter_main_sig_status": {
    "SignatureStatus": [
      "errorChaining",
      "errorCode_endpoint",
      "errorExpired",
      "trusted",
      "Valid"
    ]
  },
  "filter_main_signed_null": {
    "Signed": null
  },
  "filter_main_signed_empty": {
    "Signed": [
      "",
      "-"
    ]
  },
  "filter_main_sig_status_null": {
    "SignatureStatus": null
  },
  "filter_main_sig_status_empty": {
    "SignatureStatus": [
      "",
      "-"
    ]
  },
  "filter_main_windows_installer": {
    "Image": [
      "C:\\Windows\\SysWOW64\\rundll32.exe",
      "C:\\Windows\\System32\\rundll32.exe"
    ],
    "ImageLoaded|startswith": "C:\\Windows\\Installer\\",
    "ImageLoaded|endswith": [
      ".tmp-\\Microsoft.Deployment.WindowsInstaller.dll",
      ".tmp-\\Avira.OE.Setup.CustomActions.dll"
    ]
  },
  "filter_main_assembly": {
    "Image|startswith": [
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\Microsoft.NET\\Framework64"
    ],
    "Image|endswith": "\\RegAsm.exe",
    "ImageLoaded|endswith": ".dll",
    "ImageLoaded|startswith": "C:\\Windows\\assembly\\NativeImages"
  },
  "filter_optional_klite_codec": {
    "Image": [
      "C:\\Windows\\SysWOW64\\regsvr32.exe",
      "C:\\Windows\\System32\\regsvr32.ex

References:
  - https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion
  - https://akhere.hashnode.dev/hunting-unsigned-dlls-using-kql
  - https://unit42.paloaltonetworks.com/unsigned-dlls/?web_view=true
Sigma Detection Rule: Potential DLL Sideloading Via comctl32.dll
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash)
Date: 2022-12-16
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Detection logic:
{
  "selection": {
    "ImageLoaded|startswith": [
      "C:\\Windows\\System32\\logonUI.exe.local\\",
      "C:\\Windows\\System32\\werFault.exe.local\\",
      "C:\\Windows\\System32\\consent.exe.local\\",
      "C:\\Windows\\System32\\narrator.exe.local\\",
      "C:\\windows\\system32\\wermgr.exe.local\\"
    ],
    "ImageLoaded|endswith": "\\comctl32.dll"
  },
  "condition": "selection"
}

References:
  - https://github.com/binderlabs/DirCreate2System
  - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt
Sigma Detection Rule: MMC Loading Script Engines DLLs
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-02-05
ATT&CK techniques: T1059.005, T1218.014
Log source: windows/image_load

Description:
Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt
to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\mmc.exe",
    "ImageLoaded|endswith": [
      "\\vbscript.dll",
      "\\jscript.dll",
      "\\jscript9.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://www.elastic.co/security-labs/grimresource
Sigma Detection Rule: PowerShell Core DLL Loaded Via Office Application
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-01
Log source: windows/image_load

Description:
Detects PowerShell core DLL being loaded by an Office Product

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\excel.exe",
      "\\mspub.exe",
      "\\outlook.exe",
      "\\onenote.exe",
      "\\onenoteim.exe",
      "\\powerpnt.exe",
      "\\winword.exe"
    ],
    "ImageLoaded|contains": [
      "\\System.Management.Automation.Dll",
      "\\System.Management.Automation.ni.Dll"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Greg (rule)
Date: 2022-06-17
ATT&CK techniques: T1202
Log source: windows/image_load

Description:
Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library

Detection logic:
{
  "selection": {
    "Image|endswith": "\\msdt.exe",
    "ImageLoaded|endswith": "\\sdiageng.dll"
  },
  "condition": "selection"
}

References:
  - https://www.securonix.com/blog/detecting-microsoft-msdt-dogwalk/
Sigma Detection Rule: Remote DLL Load Via Rundll32.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-18
ATT&CK techniques: T1204.002
Log source: windows/image_load

Description:
Detects a remote DLL load event via "rundll32.exe".

Detection logic:
{
  "selection": {
    "Image|endswith": "\\rundll32.exe",
    "ImageLoaded|startswith": "\\\\\\\\"
  },
  "condition": "selection"
}

References:
  - https://github.com/gabe-k/themebleed
  - Internal Research
Sigma Detection Rule: Potential EACore.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-08-03
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "EACore.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\EACore.dll"
  },
  "filter_main_legit_path": {
    "Image|contains|all": [
      "C:\\Program Files\\Electronic Arts\\EA Desktop\\",
      "\\EACoreServer.exe"
    ],
    "ImageLoaded|startswith": "C:\\Program Files\\Electronic Arts\\EA Desktop\\"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
Sigma Detection Rule: Potential Iviewers.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-03-21
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\iviewers.dll"
  },
  "filter": {
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\Windows Kits\\",
      "C:\\Program Files\\Windows Kits\\"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://www.secureworks.com/research/shadowpad-malware-analysis
Sigma Detection Rule: PCRE.NET Package Image Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-10-29
ATT&CK techniques: T1059
Log source: windows/image_load

Description:
Detects processes loading modules related to PCRE.NET package

Detection logic:
{
  "selection": {
    "ImageLoaded|contains": "\\AppData\\Local\\Temp\\ba9ea7344a4a5f591d6e5dc32a13494b\\"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/rbmaslen/status/[PII_REDACTED]91970051
  - https://twitter.com/tifkin_/status/[PII_REDACTED]57365248
Sigma Detection Rule: Potential DLL Sideloading Via VMware Xfer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-02
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL

Detection logic:
{
  "selection": {
    "Image|endswith": "\\VMwareXferlogs.exe",
    "ImageLoaded|endswith": "\\glib-2.0.dll"
  },
  "filter": {
    "ImageLoaded|startswith": "C:\\Program Files\\VMware\\"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/