Microsoft Defender Blocked from Loading Unsigned DLL

Severity: high
Author: Bhabesh Raj
Source: upstream

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1574.001` Hijack Execution Flow: DLL
Privilege Escalation	`T1574.001` Hijack Execution Flow: DLL
Defense Evasion	`T1574.001` Hijack Execution Flow: DLL

Event coverage

Provider	Event ID	Title
Security-Mitigations	11	Process 'ProcessPath' (PID ProcessId) would have been blocked from loading the non-Microsoft-signed binary 'ImageName'.
Security-Mitigations	12	Process 'ProcessPath' (PID ProcessId) was blocked from loading the non-Microsoft-signed binary 'ImageName'.

Stages and Predicates

Stage 1: `selection`

or:
ProcessPath|endswith: '\MpCmdRun.exe'
ProcessPath|endswith: '\NisSrv.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`ProcessPath`	ends_with	`\MpCmdRun.exe` `\NisSrv.exe`

Neighbors

Often fire together

Rules that target events appearing in the same incident timelines. They pattern-match on adjacent steps of the same TTP, so an alert from one is often paired with alerts from these. Useful for triage context and for assembling chained-detection rules.

Unsigned Binary Loaded From Suspicious Location [sigma]
Registry Entries For Azorult Malware [sigma]

Share event IDs (chain-detection candidates)

Rules that observe the same Windows event-ID pairs as this one. If you're authoring a multi-stage / sequence rule that spans these events, these are the existing detections that already cover one or both endpoints.

Unsigned Binary Loaded From Suspicious Location [sigma]