Detection rules › Sigma

Unsigned Binary Loaded From Suspicious Location

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1574.001 Hijack Execution Flow: DLL
Privilege EscalationT1574.001 Hijack Execution Flow: DLL
Defense EvasionT1574.001 Hijack Execution Flow: DLL

Event coverage

ProviderEvent IDTitle
Security-Mitigations11Process 'ProcessPath' (PID ProcessId) would have been blocked from loading the non-Microsoft-signed binary 'ImageName'.
Security-Mitigations12Process 'ProcessPath' (PID ProcessId) was blocked from loading the non-Microsoft-signed binary 'ImageName'.

Stages and Predicates

Stage 1: selection

or:
ImageName|contains: 'C:\Windows\TEMP\'
ImageName|contains: '\AppData\Local\Temp\'
ImageName|contains: '\Desktop\'
ImageName|contains: '\Downloads\'
ImageName|contains: '\PerfLogs\'
ImageName|contains: '\Users\Public\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ImageNamematch
  • C:\Windows\TEMP\
  • \AppData\Local\Temp\ corpus 9 (sigma 9)
  • \Desktop\ corpus 6 (sigma 6)
  • \Downloads\ corpus 8 (sigma 8)
  • \PerfLogs\ corpus 3 (sigma 3)
  • \Users\Public\ corpus 8 (sigma 8)

Neighbors

Often fire together

Rules that target events appearing in the same incident timelines. They pattern-match on adjacent steps of the same TTP, so an alert from one is often paired with alerts from these. Useful for triage context and for assembling chained-detection rules.

Share event IDs (chain-detection candidates)

Rules that observe the same Windows event-ID pairs as this one. If you're authoring a multi-stage / sequence rule that spans these events, these are the existing detections that already cover one or both endpoints.