Sigma rule: Signed DLL Loaded With Missing PE Version Metadata

Rule

Title

Signed DLL Loaded With Missing PE Version Metadata

Status

experimental

Level

low

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-05-21

File

rules-threat-hunting/windows/image_load/image_load_win_signed_dll_no_metadata.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the loading of a digitally signed DLL whose PE version-info resource is entirely missing.
Legitimate signed DLLs from reputable vendors often carry populated metadata fields (Description, Company, Product, OriginalFileName, FileVersion).
An attacker who signs a purpose-built or hollowed DLL with a stolen, mis-issued, or cheaply purchased code-signing certificate will often omit these fields, producing a valid signature with no accompanying version info.
This pattern is observed in DLL side-loading, search-order hijacking, and certificate-abuse campaigns where signing is used purely to satisfy security-product trust checks.

Hunting Hypothesis:
- Investigate the signing certificate (issuer, subject, validity window, thumbprint) for disposable or recently issued CAs and cross-reference against known threat-actor certificates.
- Examine the DLL's on-disk path relative to the loading process — paths outside standard system directories or inside application folders susceptible to search-order hijacking are high-priority leads.
- Correlate with the parent process context; DLLs loaded into high-value targets such as lsass.exe, svchost.exe, or browser processes warrant immediate escalation.

Note:
The "selection_metadata_null" selection matches fields with a null value.
Some backends may interpret null field conditions as "field does not exist" rather than "field has a null value", which would change the detection semantics.
If your backend does not support or support null-value matching in different ways than expected, you may need to adjust the rule logic accordingly or remove the "selection_metadata_null" condition.

Log source

product

windows

category

image_load

Detection

selection_signed:
    Signed: true
    SignatureStatus: 'Valid'
selection_metadata_empty:
    Description:
        - '-'
        - ''
    Company:
        - '-'
        - ''
    Product:
        - '-'
        - ''
    OriginalFileName:
        - '-'
        - ''
    FileVersion:
        - '-'
        - ''
selection_metadata_null:
    Description: null
    Company: null
    Product: null
    OriginalFileName: null
    FileVersion: null
filter_main_legitimate_path:
    ImageLoaded|startswith:
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
filter_main_ms_signature:
    Signature|startswith: 'Microsoft'
condition: selection_signed and 1 of selection_metadata_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate signed DLLs with incomplete or missing version metadata

Tags

• attack.stealth
• attack.execution
• attack.t1574.001
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1574.001

References

• Internal Research

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/image_load/image_load_win_signed_dll_no_metadata.yml