Detection rules › Sigma
Potential DLL Sideloading Of Non-Existent DLLs From System Folders
Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1574.001 Hijack Execution Flow: DLL |
| Privilege Escalation | T1574.001 Hijack Execution Flow: DLL |
| Defense Evasion | T1574.001 Hijack Execution Flow: DLL |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 7 | Image loaded |
Stages and Predicates
Stage 1: selection
or:
ImageLoaded|endswith: ':\Windows\System32\TSMSISrv.dll'
ImageLoaded|endswith: ':\Windows\System32\TSVIPSrv.dll'
ImageLoaded|endswith: ':\Windows\System32\WLBSCTRL.dll'
ImageLoaded|endswith: ':\Windows\System32\WptsExtensions.dll'
ImageLoaded|endswith: ':\Windows\System32\axeonoffhelper.dll'
ImageLoaded|endswith: ':\Windows\System32\cdpsgshims.dll'
ImageLoaded|endswith: ':\Windows\System32\oci.dll'
ImageLoaded|endswith: ':\Windows\System32\offdmpsvc.dll'
ImageLoaded|endswith: ':\Windows\System32\shellchromeapi.dll'
ImageLoaded|endswith: ':\Windows\System32\wbem\wbemcomn.dll'
ImageLoaded|endswith: ':\Windows\System32\wow64log.dll'
Stage 2: not 1 of filter_main_ms_signed
Signature: 'Microsoft Windows'
SignatureStatus: Valid
Signed: true
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ImageLoaded | ends_with |
|
Signature | eq |
|
SignatureStatus | eq |
|
Signed | eq |
|