Potential System DLL Sideloading From Non System Locations

Title: Potential System DLL Sideloading From Non System Locations
Status: test
Description:Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).
References:
  -https://hijacklibs.net/
  -https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/
  -https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/
  -https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md
  -https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
  -https://www.sophos.com/en-us/blog/finding-minhook-in-a-sideloading-attack-and-sweden-too
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-14
modified:2026-07-10
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    ImageLoaded|endswith:
      -'\aclui.dll'
      -'\activeds.dll'
      -'\adsldpc.dll'
      -'\aepic.dll'
      -'\apphelp.dll'
      -'\applicationframe.dll'
      -'\appvpolicy.dll'
      -'\appxalluserstore.dll'
      -'\appxdeploymentclient.dll'
      -'\archiveint.dll'
      -'\atl.dll'
      -'\audioses.dll'
      -'\auditpolcore.dll'
      -'\authfwcfg.dll'
      -'\authz.dll'
      -'\avrt.dll'
      -'\batmeter.dll'
      -'\bcd.dll'
      -'\bcp47langs.dll'
      -'\bcp47mrm.dll'
      -'\bcrypt.dll'
      -'\bderepair.dll'
      -'\bootmenuux.dll'
      -'\bootux.dll'
      -'\cabinet.dll'
      -'\cabview.dll'
      -'\certcli.dll'
      -'\certenroll.dll'
      -'\cfgmgr32.dll'
      -'\cldapi.dll'
      -'\clipc.dll'
      -'\clusapi.dll'
      -'\cmpbk32.dll'
      -'\cmutil.dll'
      -'\coloradapterclient.dll'
      -'\colorui.dll'
      -'\comdlg32.dll'
      -'\configmanager2.dll'
      -'\connect.dll'
      -'\coredplus.dll'
      -'\coremessaging.dll'
      -'\coreuicomponents.dll'
      -'\credui.dll'
      -'\cryptbase.dll'
      -'\cryptdll.dll'
      -'\cryptsp.dll'
      -'\cryptui.dll'
      -'\cryptxml.dll'
      -'\cscapi.dll'
      -'\cscobj.dll'
      -'\cscui.dll'
      -'\d2d1.dll'
      -'\d3d10_1.dll'
      -'\d3d10_1core.dll'
      -'\d3d10.dll'
      -'\d3d10core.dll'
      -'\d3d10warp.dll'
      -'\d3d11.dll'
      -'\d3d12.dll'
      -'\d3d9.dll'
      -'\d3dx9_43.dll'
      -'\dataexchange.dll'
      -'\davclnt.dll'
      -'\dcntel.dll'
      -'\dcomp.dll'
      -'\defragproxy.dll'
      -'\desktopshellext.dll'
      -'\deviceassociation.dll'
      -'\devicecredential.dll'
      -'\devicepairing.dll'
      -'\devobj.dll'
      -'\devrtl.dll'
      -'\dhcpcmonitor.dll'
      -'\dhcpcsvc.dll'
      -'\dhcpcsvc6.dll'
      -'\directmanipulation.dll'
      -'\dismapi.dll'
      -'\dismcore.dll'
      -'\dmcfgutils.dll'
      -'\dmcmnutils.dll'
      -'\dmcommandlineutils.dll'
      -'\dmenrollengine.dll'
      -'\dmenterprisediagnostics.dll'
      -'\dmiso8601utils.dll'
      -'\dmoleaututils.dll'
      -'\dmprocessxmlfiltered.dll'
      -'\dmpushproxy.dll'
      -'\dmxmlhelputils.dll'
      -'\dnsapi.dll'
      -'\dot3api.dll'
      -'\dot3cfg.dll'
      -'\dpx.dll'
      -'\drprov.dll'
      -'\drvstore.dll'
      -'\dsclient.dll'
      -'\dsparse.dll'
      -'\dsprop.dll'
      -'\dsreg.dll'
      -'\dsrole.dll'
      -'\dui70.dll'
      -'\duser.dll'
      -'\dusmapi.dll'
      -'\dwmapi.dll'
      -'\dwmcore.dll'
      -'\dwrite.dll'
      -'\dxcore.dll'
      -'\dxgi.dll'
      -'\dxva2.dll'
      -'\dynamoapi.dll'
      -'\eappcfg.dll'
      -'\eappprxy.dll'
      -'\edgeiso.dll'
      -'\edputil.dll'
      -'\efsadu.dll'
      -'\efsutil.dll'
      -'\esent.dll'
      -'\execmodelproxy.dll'
      -'\explorerframe.dll'
      -'\fastprox.dll'
      -'\faultrep.dll'
      -'\fddevquery.dll'
      -'\feclient.dll'
      -'\fhcfg.dll'
      -'\fhsvcctl.dll'
      -'\firewallapi.dll'
      -'\flightsettings.dll'
      -'\fltlib.dll'
      -'\framedynos.dll'
      -'\fveapi.dll'
      -'\fveskybackup.dll'
      -'\fvewiz.dll'
      -'\fwbase.dll'
      -'\fwcfg.dll'
      -'\fwpolicyiomgr.dll'
      -'\fwpuclnt.dll'
      -'\fxsapi.dll'
      -'\fxsst.dll'
      -'\fxstiff.dll'
      -'\getuname.dll'
      -'\gpapi.dll'
      -'\hid.dll'
      -'\hnetmon.dll'
      -'\httpapi.dll'
      -'\icmp.dll'
      -'\idstore.dll'
      -'\ieadvpack.dll'
      -'\iedkcs32.dll'
      -'\iernonce.dll'
      -'\iertutil.dll'
      -'\ifmon.dll'
      -'\ifsutil.dll'
      -'\inproclogger.dll'
      -'\iphlpapi.dll'
      -'\iri.dll'
      -'\iscsidsc.dll'
      -'\iscsium.dll'
      -'\isv.exe_rsaenh.dll'
      -'\iumbase.dll'
      -'\iumsdk.dll'
      -'\joinutil.dll'
      -'\kdstub.dll'
      -'\ksuser.dll'
      -'\ktmw32.dll'
      -'\licensemanagerapi.dll'
      -'\licensingdiagspp.dll'
      -'\linkinfo.dll'
      -'\loadperf.dll'
      -'\lockhostingframework.dll'
      -'\logoncli.dll'
      -'\logoncontroller.dll'
      -'\lpksetupproxyserv.dll'
      -'\lrwizdll.dll'
      -'\magnification.dll'
      -'\maintenanceui.dll'
      -'\mapistub.dll'
      -'\mbaexmlparser.dll'
      -'\mdmdiagnostics.dll'
      -'\mfc42u.dll'
      -'\mfcore.dll'
      -'\mfplat.dll'
      -'\mi.dll'
      -'\midimap.dll'
      -'\mintdh.dll'
      -'\miutils.dll'
      -'\mlang.dll'
      -'\mmdevapi.dll'
      -'\mobilenetworking.dll'
      -'\mpr.dll'
      -'\mprapi.dll'
      -'\mrmcorer.dll'
      -'\msacm32.dll'
      -'\mscms.dll'
      -'\mscoree.dll'
      -'\msctf.dll'
      -'\msctfmonitor.dll'
      -'\msdrm.dll'
      -'\msdtctm.dll'
      -'\msftedit.dll'
      -'\msi.dll'
      -'\msiso.dll'
      -'\msutb.dll'
      -'\msvcp110_win.dll'
      -'\mswb7.dll'
      -'\mswsock.dll'
      -'\msxml3.dll'
      -'\mtxclu.dll'
      -'\napinsp.dll'
      -'\ncrypt.dll'
      -'\ndfapi.dll'
      -'\netapi32.dll'
      -'\netid.dll'
      -'\netiohlp.dll'
      -'\netjoin.dll'
      -'\netplwiz.dll'
      -'\netprofm.dll'
      -'\netprovfw.dll'
      -'\netsetupapi.dll'
      -'\netshell.dll'
      -'\nettrace.dll'
      -'\netutils.dll'
      -'\networkexplorer.dll'
      -'\newdev.dll'
      -'\ninput.dll'
      -'\nlaapi.dll'
      -'\nlansp_c.dll'
      -'\npmproxy.dll'
      -'\nshhttp.dll'
      -'\nshipsec.dll'
      -'\nshwfp.dll'
      -'\ntdsapi.dll'
      -'\ntlanman.dll'
      -'\ntlmshared.dll'
      -'\ntmarta.dll'
      -'\ntshrui.dll'
      -'\oleacc.dll'
      -'\omadmapi.dll'
      -'\onex.dll'
      -'\opcservices.dll'
      -'\osbaseln.dll'
      -'\osksupport.dll'
      -'\osuninst.dll'
      -'\p2p.dll'
      -'\p2pnetsh.dll'
      -'\p9np.dll'
      -'\pcaui.dll'
      -'\pdh.dll'
      -'\peerdistsh.dll'
      -'\pkeyhelper.dll'
      -'\pla.dll'
      -'\playsndsrv.dll'
      -'\pnrpnsp.dll'
      -'\policymanager.dll'
      -'\polstore.dll'
      -'\powrprof.dll'
      -'\printui.dll'
      -'\prntvpt.dll'
      -'\profapi.dll'
      -'\propsys.dll'
      -'\proximitycommon.dll'
      -'\proximityservicepal.dll'
      -'\prvdmofcomp.dll'
      -'\puiapi.dll'
      -'\radcui.dll'
      -'\rasapi32.dll'
      -'\rasdlg.dll'
      -'\rasgcw.dll'
      -'\rasman.dll'
      -'\rasmontr.dll'
      -'\reagent.dll'
      -'\regapi.dll'
      -'\reseteng.dll'
      -'\resetengine.dll'
      -'\resutils.dll'
      -'\rmclient.dll'
      -'\rpcnsh.dll'
      -'\rsaenh.dll'
      -'\rtutils.dll'
      -'\rtworkq.dll'
      -'\samcli.dll'
      -'\samlib.dll'
      -'\sapi_onecore.dll'
      -'\sas.dll'
      -'\scansetting.dll'
      -'\scecli.dll'
      -'\schedcli.dll'
      -'\secur32.dll'
      -'\security.dll'
      -'\sensapi.dll'
      -'\shell32.dll'
      -'\shfolder.dll'
      -'\slc.dll'
      -'\snmpapi.dll'
      -'\spectrumsyncclient.dll'
      -'\spp.dll'
      -'\sppc.dll'
      -'\sppcext.dll'
      -'\srclient.dll'
      -'\srcore.dll'
      -'\srmtrace.dll'
      -'\srpapi.dll'
      -'\srvcli.dll'
      -'\ssp_isv.exe_rsaenh.dll'
      -'\ssp.exe_rsaenh.dll'
      -'\sspicli.dll'
      -'\ssshim.dll'
      -'\staterepository.core.dll'
      -'\structuredquery.dll'
      -'\sxshared.dll'
      -'\systemsettings.dll'
      -'\systemsettingsthresholdadminflowui.dll'
      -'\tapi32.dll'
      -'\tbs.dll'
      -'\tdh.dll'
      -'\textshaping.dll'
      -'\timesync.dll'
      -'\tpmcoreprovisioning.dll'
      -'\tquery.dll'
      -'\tsworkspace.dll'
      -'\ttdrecord.dll'
      -'\twext.dll'
      -'\twinapi.dll'
      -'\twinui.appcore.dll'
      -'\uianimation.dll'
      -'\uiautomationcore.dll'
      -'\uireng.dll'
      -'\uiribbon.dll'
      -'\umpdc.dll'
      -'\unattend.dll'
      -'\updatepolicy.dll'
      -'\upshared.dll'
      -'\urlmon.dll'
      -'\userenv.dll'
      -'\utildll.dll'
      -'\uxinit.dll'
      -'\uxtheme.dll'
      -'\vaultcli.dll'
      -'\vdsutil.dll'
      -'\version.dll'
      -'\virtdisk.dll'
      -'\vssapi.dll'
      -'\vsstrace.dll'
      -'\wbemprox.dll'
      -'\wbemsvc.dll'
      -'\wcmapi.dll'
      -'\wcnnetsh.dll'
      -'\wdi.dll'
      -'\wdscore.dll'
      -'\webservices.dll'
      -'\wecapi.dll'
      -'\wer.dll'
      -'\wevtapi.dll'
      -'\whhelper.dll'
      -'\wimgapi.dll'
      -'\winbio.dll'
      -'\winbrand.dll'
      -'\windows.storage.dll'
      -'\windows.storage.search.dll'
      -'\windows.ui.immersive.dll'
      -'\windowscodecs.dll'
      -'\windowscodecsext.dll'
      -'\windowsudk.shellcommon.dll'
      -'\winhttp.dll'
      -'\wininet.dll'
      -'\winipsec.dll'
      -'\winmde.dll'
      -'\winmm.dll'
      -'\winnsi.dll'
      -'\winrnr.dll'
      -'\winscard.dll'
      -'\winsqlite3.dll'
      -'\winsta.dll'
      -'\winsync.dll'
      -'\wkscli.dll'
      -'\wlanapi.dll'
      -'\wlancfg.dll'
      -'\wldp.dll'
      -'\wlidprov.dll'
      -'\wmiclnt.dll'
      -'\wmidcom.dll'
      -'\wmiutils.dll'
      -'\wmpdui.dll'
      -'\wmsgapi.dll'
      -'\wofutil.dll'
      -'\wpdshext.dll'
      -'\wscapi.dll'
      -'\wsdapi.dll'
      -'\wshbth.dll'
      -'\wshelper.dll'
      -'\wsmsvc.dll'
      -'\wtsapi32.dll'
      -'\wwancfg.dll'
      -'\wwapi.dll'
      -'\xmllite.dll'
      -'\xolehlp.dll'
      -'\xpsservices.dll'
      -'\xwizards.dll'
      -'\xwtpw32.dll'
      -'\amsi.dll'
      -'\appraiser.dll'
      -'\COMRES.DLL'
      -'\cryptnet.dll'
      -'\DispBroker.dll'
      -'\dsound.dll'
      -'\dxilconv.dll'
      -'\FxsCompose.dll'
      -'\FXSRESM.DLL'
      -'\msdtcVSp1res.dll'
      -'\PrintIsolationProxy.dll'
      -'\rdpendp.dll'
      -'\rpchttp.dll'
      -'\storageusage.dll'
      -'\utcutil.dll'
      -'\WfsR.dll'
      -'\igd10iumd64.dll'
      -'\igd12umd64.dll'
      -'\igdumdim64.dll'
      -'\igdusc64.dll'
      -'\TSMSISrv.dll'
      -'\TSVIPSrv.dll'
      -'\wbemcomn.dll'
      -'\WLBSCTRL.dll'
      -'\wow64log.dll'
      -'\WptsExtensions.dll'

  filter_main_generic:
    ImageLoaded|contains:
      -'C:\$WINDOWS.~BT\'
      -'C:\$WinREAgent\'
      -'C:\Windows\SoftwareDistribution\'
      -'C:\Windows\System32\'
      -'C:\Windows\SystemTemp\'
      -'C:\Windows\SysWOW64\'
      -'C:\Windows\WinSxS\'
      -'C:\Windows\SyChpe32\'

  filter_main_windows_temp:
    ImageLoaded|startswith: 'C:\Windows\Temp\'
    Image|startswith:
      -'C:\Windows\WinSxS\arm64'
      -'C:\Windows\UUS\arm64\'

    Image|endswith:
      -'\TiWorker.exe'
      -'\wuaucltcore.exe'

  filter_main_dot_net:
    ImageLoaded|startswith: 'C:\Windows\Microsoft.NET\'
    ImageLoaded|endswith: '\cscui.dll'
  filter_main_defender:
    ImageLoaded|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
    ImageLoaded|endswith: '\version.dll'
  filter_main_directx:
    ImageLoaded|startswith: 'C:\Program Files\WindowsApps\Microsoft.DirectXRuntime_'
    ImageLoaded|endswith: '\d3dx9_43.dll'
  filter_main_systemsettings:
    ImageLoaded: 'C:\Windows\ImmersiveControlPanel\SystemSettings.dll'
  filter_optional_exchange:
    ImageLoaded|startswith: 'C:\Program Files\Microsoft\Exchange Server\'
    ImageLoaded|endswith: '\mswb7.dll'
  filter_optional_arsenal_image_mounter:
    ImageLoaded|startswith: 'C:\Program Files\Arsenal-Image-Mounter-'
    ImageLoaded|endswith:
      -'\mi.dll'
      -'\miutils.dl'

  filter_optional_office_appvpolicy:
    Image: 'C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe'
    ImageLoaded: 'C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll'
  filter_optional_azure:
    ImageLoaded|startswith: 'C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\'
  filter_optional_dell:
    Image|contains:
      -'C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
      -'C:\Windows\System32\backgroundTaskHost.exe'

    ImageLoaded|startswith: 'C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
  filter_optional_dell_wldp:
    ImageLoaded|startswith: 'C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
    ImageLoaded|endswith: '\wldp.dll'
  filter_optional_checkpoint:
    Image|startswith:
      -'C:\Program Files\CheckPoint\'
      -'C:\Program Files (x86)\CheckPoint\'

    Image|endswith: '\SmartConsole.exe'
    ImageLoaded|startswith:
      -'C:\Program Files\CheckPoint\'
      -'C:\Program Files (x86)\CheckPoint\'

    ImageLoaded|endswith: '\PolicyManager.dll'
  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Legitimate applications loading their own versions of the DLLs mentioned in this rule
Level: high