deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: DotNET Assembly DLL Loaded Via Office Application
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Antonlovesdnb
Date: 2020-02-19
ATT&CK techniques: T1204.002
Log source: windows/image_load

Description:
Detects any assembly DLL being loaded by an Office Product

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\excel.exe",
      "\\mspub.exe",
      "\\onenote.exe",
      "\\onenoteim.exe",
      "\\outlook.exe",
      "\\powerpnt.exe",
      "\\winword.exe"
    ],
    "ImageLoaded|startswith": "C:\\Windows\\assembly\\"
  },
  "condition": "selection"
}

References:
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
Sigma Detection Rule: Third Party Software DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
Date: 2022-08-17
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Detection logic:
{
  "selection_lenovo": {
    "ImageLoaded|endswith": "\\commfunc.dll"
  },
  "filter_lenovo": [
    {
      "ImageLoaded|contains": "\\AppData\\local\\Google\\Chrome\\Application\\"
    },
    {
      "ImageLoaded|startswith": [
        "C:\\Program Files\\Lenovo\\Communications Utility\\",
        "C:\\Program Files (x86)\\Lenovo\\Communications Utility\\"
      ]
    }
  ],
  "selection_toshiba": {
    "ImageLoaded|endswith": "\\tosbtkbd.dll"
  },
  "filter_toshiba": {
    "ImageLoaded|startswith": [
      "C:\\Program Files\\Toshiba\\Bluetooth Toshiba Stack\\",
      "C:\\Program Files (x86)\\Toshiba\\Bluetooth Toshiba Stack\\"
    ]
  },
  "condition": "(selection_lenovo and not filter_lenovo) or (selection_toshiba and not filter_toshiba)"
}

References:
  - https://hijacklibs.net/
Sigma Detection Rule: Potential DLL Sideloading Of DBGHELP.DLL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
Date: 2022-10-25
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "dbghelp.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\dbghelp.dll"
  },
  "filter_main_generic": {
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\SoftwareDistribution\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SystemTemp\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "filter_optional_anaconda": {
    "ImageLoaded|endswith": [
      "\\Anaconda3\\Lib\\site-packages\\vtrace\\platforms\\windll\\amd64\\dbghelp.dll",
      "\\Anaconda3\\Lib\\site-packages\\vtrace\\platforms\\windll\\i386\\dbghelp.dll"
    ]
  },
  "filter_optional_epicgames": {
    "ImageLoaded|endswith": [
      "\\Epic Games\\Launcher\\Engine\\Binaries\\ThirdParty\\DbgHelp\\dbghelp.dll",
      "\\Epic Games\\MagicLegends\\x86\\dbghelp.dll"
    ]
  },
  "filter_optional_opera": {
    "ImageLoaded|contains": "opera\\Opera Installer Temp\\opera_package",
    "ImageLoaded|endswith": "\\assistant\\dbghelp.dll"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://hijacklibs.net/
Sigma Detection Rule: Potential ShellDispatch.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-06-20
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "ShellDispatch.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\ShellDispatch.dll"
  },
  "filter_main_legit_path": [
    {
      "ImageLoaded|contains|all": [
        ":\\Users\\",
        "\\AppData\\Local\\Temp\\"
      ]
    },
    {
      "ImageLoaded|contains": ":\\Windows\\Temp\\"
    }
  ],
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/
Sigma Detection Rule: DLL Loaded From Suspicious Location Via Cmspt.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-30
ATT&CK techniques: T1218.003
Log source: windows/image_load

Description:
Detects cmstp loading "dll" or "ocx" files from suspicious locations

Detection logic:
{
  "selection": {
    "Image|endswith": "\\cmstp.exe",
    "ImageLoaded|contains": [
      "\\PerfLogs\\",
      "\\ProgramData\\",
      "\\Users\\",
      "\\Windows\\Temp\\",
      "C:\\Temp\\"
    ],
    "ImageLoaded|endswith": [
      ".dll",
      ".ocx"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/TTPs/Defense%20Evasion/T1218%20-%20Signed%20Binary%20Proxy%20Execution/T1218.003%20-%20CMSTP/Procedures.yaml
Sigma Detection Rule: Abusable DLL Potential Sideloading From Suspicious Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-07-11
ATT&CK techniques: T1059
Log source: windows/image_load

Description:
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations

Detection logic:
{
  "selection_dll": {
    "ImageLoaded|endswith": [
      "\\coreclr.dll",
      "\\facesdk.dll",
      "\\HPCustPartUI.dll",
      "\\libcef.dll",
      "\\ZIPDLL.dll"
    ]
  },
  "selection_folders_1": {
    "ImageLoaded|contains": [
      ":\\Perflogs\\",
      ":\\Users\\Public\\",
      "\\Temporary Internet",
      "\\Windows\\Temp\\"
    ]
  },
  "selection_folders_2": [
    {
      "ImageLoaded|contains|all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "ImageLoaded|contains|all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "ImageLoaded|contains|all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    },
    {
      "ImageLoaded|contains|all": [
        ":\\Users\\",
        "\\Pictures\\"
      ]
    }
  ],
  "condition": "selection_dll and 1 of selection_folders_*"
}

References:
  - https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html
  - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
Sigma Detection Rule: Potential DLL Sideloading Of DBGCORE.DLL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
Date: 2022-10-25
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects DLL sideloading of "dbgcore.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\dbgcore.dll"
  },
  "filter_main_generic": {
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\SoftwareDistribution\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SystemTemp\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "filter_optional_steam": {
    "ImageLoaded|endswith": "\\Steam\\bin\\cef\\cef.win7x64\\dbgcore.dll"
  },
  "filter_optional_opera": {
    "ImageLoaded|contains": "opera\\Opera Installer Temp\\opera_package",
    "ImageLoaded|endswith": "\\assistant\\dbgcore.dll"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://hijacklibs.net/
Sigma Detection Rule: Potential Mpclient.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2022-08-02
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\mpclient.dll",
    "Image|endswith": [
      "\\MpCmdRun.exe",
      "\\NisSrv.exe"
    ]
  },
  "filter_main_known_locations": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\Windows Defender\\",
      "C:\\Program Files\\Microsoft Security Client\\",
      "C:\\Program Files\\Windows Defender\\",
      "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
Sigma Detection Rule: DLL Load By System Process From Suspicious Locations
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-17
ATT&CK techniques: T1070
Log source: windows/image_load

Description:
Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"

Detection logic:
{
  "selection": {
    "Image|startswith": "C:\\Windows\\",
    "ImageLoaded|startswith": [
      "C:\\Users\\Public\\",
      "C:\\PerfLogs\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC (Idea)
Sigma Detection Rule: Potential DCOM InternetExplorer.Application DLL Hijack - Image Load
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga
Date: 2020-10-12
ATT&CK techniques: T1021.002, T1021.003
Log source: windows/image_load

Description:
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class

Detection logic:
{
  "selection": {
    "Image|endswith": "\\Internet Explorer\\iexplore.exe",
    "ImageLoaded|endswith": "\\Internet Explorer\\iertutil.dll"
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html
Sigma Detection Rule: Potential Rcdll.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-03-13
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of rcdll.dll

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\rcdll.dll"
  },
  "filter": {
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\Microsoft Visual Studio\\",
      "C:\\Program Files (x86)\\Windows Kits\\"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
Sigma Detection Rule: Unsigned Mfdetours.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-11
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\mfdetours.dll"
  },
  "filter_main_legit_path": {
    "ImageLoaded|contains": ":\\Program Files (x86)\\Windows Kits\\10\\bin\\",
    "SignatureStatus": "Valid"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research
Sigma Detection Rule: HackTool - SILENTTRINITY Stager DLL Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Aleksey Potapov, oscd.community
Date: 2019-10-22
ATT&CK techniques: T1071
Log source: windows/image_load

Description:
Detects SILENTTRINITY stager dll loading activity

Detection logic:
{
  "selection": {
    "Description|contains": "st2stager"
  },
  "condition": "selection"
}

References:
  - https://github.com/byt3bl33d3r/SILENTTRINITY
Sigma Detection Rule: WMI Persistence - Command Line Event Consumer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Thomas Patzke
Date: 2018-03-07
ATT&CK techniques: T1546.003
Log source: windows/image_load

Description:
Detects WMI command line event consumers

Detection logic:
{
  "selection": {
    "Image": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
    "ImageLoaded|endswith": "\\wbemcons.dll"
  },
  "condition": "selection"
}

References:
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
Sigma Detection Rule: Suspicious Volume Shadow Copy Vssapi.dll Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-10-31
ATT&CK techniques: T1490
Log source: windows/image_load

Description:
Detects the image load of VSS DLL by uncommon executables

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\vssapi.dll"
  },
  "filter_main_windows": [
    {
      "Image": [
        "C:\\Windows\\explorer.exe",
        "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe"
      ]
    },
    {
      "Image|startswith": [
        "C:\\Windows\\System32\\",
        "C:\\Windows\\SysWOW64\\",
        "C:\\Windows\\Temp\\{",
        "C:\\Windows\\WinSxS\\"
      ]
    }
  ],
  "filter_main_program_files": {
    "Image|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "filter_main_null_image": {
    "Image": null
  },
  "filter_optional_programdata_packagecache": {
    "Image|startswith": "C:\\ProgramData\\Package Cache\\"
  },
  "filter_optional_avira": {
    "Image|contains|all": [
      "\\temp\\is-",
      "\\avira_system_speedup.tmp"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/ORCx41/DeleteShadowCopies
Sigma Detection Rule: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-27
ATT&CK techniques: T1003, T1685
Log source: windows/image_load

Description:
Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.
These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.


Detection logic:
{
  "selection_img": {
    "Image|contains": [
      ":\\Perflogs\\",
      ":\\Temp\\",
      ":\\Users\\Public\\",
      "\\$Recycle.Bin\\",
      "\\Contacts\\",
      "\\Documents\\",
      "\\Favorites\\",
      "\\Favourites\\",
      "\\inetpub\\wwwroot\\",
      "\\Music\\",
      "\\Pictures\\",
      "\\Start Menu\\Programs\\Startup\\",
      "\\Users\\Default\\",
      "\\Videos\\"
    ]
  },
  "selection_dll": {
    "ImageLoaded|endswith": [
      "\\dbgcore.dll",
      "\\dbghelp.dll"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.axelarator.net/hunting-for-edr-freeze/
  - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
  - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
Sigma Detection Rule: Microsoft Office DLL Sideload
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
Date: 2022-08-17
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\outllib.dll"
  },
  "filter": {
    "ImageLoaded|startswith": [
      "C:\\Program Files\\Microsoft Office\\OFFICE",
      "C:\\Program Files (x86)\\Microsoft Office\\OFFICE",
      "C:\\Program Files\\Microsoft Office\\Root\\OFFICE",
      "C:\\Program Files (x86)\\Microsoft Office\\Root\\OFFICE"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://hijacklibs.net/
Sigma Detection Rule: Potential DLL Sideloading Using Coregen.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-31
ATT&CK techniques: T1218, T1055
Log source: windows/image_load

Description:
Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\coregen.exe"
  },
  "filter_main_legit_paths": {
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\Microsoft Silverlight\\",
      "C:\\Program Files\\Microsoft Silverlight\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Coregen/
Sigma Detection Rule: Potential Vcruntime140 DLL Sideloading
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-12
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library.
Threat actors have been observed using DLL sideloading techniques to load malicious payloads under the guise of legitimate applications such as SqlWriter, SqlDumper etc.
Notably, APT29 has been documented leveraging WinELOADER to sideload vcruntime140.dll for executing malicious code.


Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\vcruntime140.dll"
  },
  "filter_main_legitimate_path": {
    "ImageLoaded|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "filter_main_legitimate_signer": {
    "Signed": true,
    "SignatureStatus": "Valid",
    "Description": "Microsoft\u00ae C Runtime Library"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties
  - https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader
  - https://www.nextron-systems.com/2023/09/15/detecting-janelarat-with-yara-and-thor/
Sigma Detection Rule: Potential DLL Sideloading Of MpSvc.DLL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema
Date: 2024-07-11
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "MpSvc.dll".

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\MpSvc.dll"
  },
  "filter_main_generic": {
    "ImageLoaded|startswith": [
      "C:\\Program Files\\Windows Defender\\",
      "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://hijacklibs.net/entries/microsoft/built-in/mpsvc.html
Sigma Detection Rule: Potential Waveedit.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-06-14
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\waveedit.dll"
  },
  "filter_main_legit_path": {
    "Image": [
      "C:\\Program Files (x86)\\Nero\\Nero Apps\\Nero WaveEditor\\waveedit.exe",
      "C:\\Program Files\\Nero\\Nero Apps\\Nero WaveEditor\\waveedit.exe"
    ],
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\Nero\\Nero Apps\\Nero WaveEditor\\",
      "C:\\Program Files\\Nero\\Nero Apps\\Nero WaveEditor\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html
Sigma Detection Rule: Suspicious Renamed Comsvcs DLL Loaded By Rundll32
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-14
ATT&CK techniques: T1003.001
Log source: windows/image_load

Description:
Detects rundll32 loading a renamed comsvcs.dll to dump process memory

Detection logic:
{
  "selection": {
    "Image|endswith": "\\rundll32.exe",
    "Hashes|contains": [
      "IMPHASH=eed93054cb555f3de70eaa9787f32ebb",
      "IMPHASH=5e0dbdec1fce52daae251a110b4f309d",
      "IMPHASH=eadbccbb324829acb5f2bbe87e5549a8",
      "IMPHASH=407ca0f7b523319d758a40d7c0193699",
      "IMPHASH=281d618f4e6271e527e6386ea6f748de"
    ]
  },
  "filter": {
    "ImageLoaded|endswith": "\\comsvcs.dll"
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/sbousseaden/status/[PII_REDACTED]51228419
Sigma Detection Rule: PowerShell Core DLL Loaded By Non PowerShell Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2019-11-14
ATT&CK techniques: T1059.001
Log source: windows/image_load

Description:
Detects loading of essential DLLs used by PowerShell by non-PowerShell process.
Detects behavior similar to meterpreter's "load powershell" extension.


Detection logic:
{
  "selection": [
    {
      "Description": "System.Management.Automation"
    },
    {
      "OriginalFileName": "System.Management.Automation.dll"
    },
    {
      "ImageLoaded|endswith": [
        "\\System.Management.Automation.dll",
        "\\System.Management.Automation.ni.dll"
      ]
    }
  ],
  "filter_main_powershell": {
    "Image": [
      "C:\\Program Files\\PowerShell\\7-preview\\pwsh.exe",
      "C:\\Program Files\\PowerShell\\7\\pwsh.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
    ]
  },
  "filter_main_pwsh_preview": {
    "Image|contains": [
      "C:\\Program Files\\WindowsApps\\Microsoft.PowerShellPreview",
      "\\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShellPreview"
    ],
    "Image|endswith": "\\pwsh.exe"
  },
  "filter_main_generic": {
    "Image": [
      "C:\\Windows\\System32\\dsac.exe",
      "C:\\WINDOWS\\System32\\RemoteFXvGPUDisablement.exe",
      "C:\\Windows\\System32\\runscripthelper.exe",
      "C:\\WINDOWS\\System32\\sdiagnhost.exe",
      "C:\\Windows\\System32\\ServerManager.exe",
      "C:\\Windows\\System32\\SyncAppvPublishingServer.exe",
      "C:\\Windows\\System32\\winrshost.exe",
      "C:\\Windows\\System32\\wsmprovhost.exe",
      "C:\\Windows\\SysWOW64\\w

References:
  - https://adsecurity.org/?p=2921
  - https://github.com/p3nt4/PowerShdll
Sigma Detection Rule: Potential Wazuh Security Platform DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-03-13
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\libwazuhshared.dll",
      "\\libwinpthread-1.dll"
    ]
  },
  "filter_main_generic": {
    "ImageLoaded|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "filter_optional_mingw64": {
    "ImageLoaded|contains": [
      "\\AppData\\Local\\",
      "\\ProgramData\\"
    ],
    "ImageLoaded|endswith": "\\mingw64\\bin\\libwinpthread-1.dll"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html