Sigma rule: Lazarus APT DLL Sideloading Activity

Rule

Title

Lazarus APT DLL Sideloading Activity

Status

test

Level

high

Author

Thurein Oo, Nasreddine Bencherchali (Nextron Systems)

Date

2023-10-18

Modified

2026-11-02

File

rules-emerging-threats/2023/TA/Lazarus/image_load_apt_lazarus_side_load_activity.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Log source

product

windows

category

image_load

Detection

selection_mscoree:
    Image: 'C:\ProgramShared\PresentationHost.exe'
    ImageLoaded|endswith: ':\ProgramShared\mscoree.dll'
selection_colorui:
    Image: 'C:\ProgramData\Adobe\colorcpl.exe'
    ImageLoaded: 'C:\ProgramData\Adobe\colorui.dll'
selection_mapistub:
    Image: 'C:\ProgramData\Oracle\Java\fixmapi.exe'
    ImageLoaded: 'C:\ProgramData\Oracle\Java\mapistub.dll'
selection_hid:
    Image: 'C:\ProgramData\Adobe\ARM\tabcal.exe'
    ImageLoaded: 'C:\ProgramData\Adobe\ARM\HID.dll'
condition: 1 of selection_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.privilege-escalation
• attack.persistence
• attack.execution
• attack.stealth
• attack.t1574.001
• attack.g0032
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• G0032
• T1574.001

References

• https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/
• https://www.bleepingcomputer.com/news/security/lazarus-hackers-breach-aerospace-firm-with-new-lightlesscan-malware/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/TA/Lazarus/image_load_apt_lazarus_side_load_activity.yml