Sigma rule: Potential Antivirus Software DLL Sideloading

Rule

Title

Potential Antivirus Software DLL Sideloading

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)

Date

2022-08-17

Modified

2026-10-19

File

rules/windows/image_load/image_load_side_load_antivirus.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential DLL sideloading of DLLs that are part of antivirus software such as McAfee, Symantec...etc

Log source

product

windows

category

image_load

Detection

# Bitdefender
selection_bitdefender:
    ImageLoaded|endswith: '\log.dll'
filter_log_dll_bitdefender:
    ImageLoaded|startswith:
        - 'C:\Program Files\Bitdefender Antivirus Free\'
        - 'C:\Program Files (x86)\Bitdefender Antivirus Free\'
filter_log_dll_dell_sar:
    Image: 'C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe'
    ImageLoaded:
        - 'C:\Program Files\Dell\SARemediation\plugin\log.dll'
        - 'C:\Program Files\Dell\SARemediation\audit\log.dll'
filter_log_dll_canon:
    ImageLoaded|startswith: 'C:\Program Files\Canon\MyPrinter\'
filter_log_dll_avast:
    ImageLoaded:
        - 'C:\Program Files\AVAST Software\Avast\log.dll'
        - 'C:\Program Files (x86)\AVAST Software\Avast\log.dll'
filter_log_dll_avg:
    ImageLoaded:
        - 'C:\Program Files\AVG\Antivirus\log.dll'
        - 'C:\Program Files (x86)\AVG\Antivirus\log.dll'
# F-Secure
selection_fsecure:
    ImageLoaded|endswith: '\qrt.dll'
filter_fsecure:
    ImageLoaded|startswith:
        - 'C:\Program Files\F-Secure\Anti-Virus\'
        - 'C:\Program Files (x86)\F-Secure\Anti-Virus\'
# McAfee
selection_mcafee:
    ImageLoaded|endswith:
        - '\ashldres.dll'
        - '\lockdown.dll'
        - '\vsodscpl.dll'
filter_mcafee:
    ImageLoaded|startswith:
        - 'C:\Program Files\McAfee\'
        - 'C:\Program Files (x86)\McAfee\'
# CyberArk
selection_cyberark:
    ImageLoaded|endswith: '\vftrace.dll'
filter_cyberark:
    ImageLoaded|startswith:
        - 'C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\'
        - 'C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32\'
# Avast
selection_avast:
    ImageLoaded|endswith: '\wsc.dll'
filter_wsc_dll_avast:
    ImageLoaded|startswith:
        - 'C:\Program Files\AVAST Software\Avast\'
        - 'C:\Program Files (x86)\AVAST Software\Avast\'
filter_wsc_dll_avg:
    ImageLoaded|startswith:
        - 'C:\Program Files\AVG\Antivirus\'
        - 'C:\Program Files (x86)\AVG\Antivirus\'
# ESET
selection_eset_deslock:
    ImageLoaded|endswith: '\DLPPREM32.dll'
filter_eset_deslock:
    ImageLoaded|startswith:
        - 'C:\Program Files\ESET'
        - 'C:\Program Files (x86)\ESET'
# Trend Micro Titanium
selection_titanium:
    ImageLoaded|endswith: '\tmdbglog.dll'
filter_titanium:
    ImageLoaded|startswith:
        - 'C:\Program Files\Trend Micro\Titanium\'
        - 'C:\Program Files (x86)\Trend Micro\Titanium\'
# Zillya Antivirus
selection_zillya:
    ImageLoaded|endswith: '\SystemStatus.dll'
filter_zillya_ovron:
    ImageLoaded|startswith:
        - 'C:\Program Files\Zillya Antivirus\'
        - 'C:\Program Files (x86)\Zillya Antivirus\'
        - 'C:\Program Files\Zillya Total Security\'
        - 'C:\Program Files (x86)\Zillya Total Security\'
        - 'C:\Program Files\Ovron Total Security\'
        - 'C:\Program Files (x86)\Ovron Total Security\'
condition: (selection_bitdefender and not 1 of filter_log_dll_*)
           or (selection_fsecure and not filter_fsecure)
           or (selection_mcafee and not filter_mcafee)
           or (selection_cyberark and not filter_cyberark)
           or (selection_avast and not 1 of filter_wsc_dll_*)
           or (selection_titanium and not filter_titanium)
           or (selection_eset_deslock and not filter_eset_deslock)
           or (selection_zillya and not filter_zillya_ovron)

False positives (as the rule lists them)

• Applications that load the same dlls mentioned in the detection section. Investigate them and filter them out if a lot FPs are caused.
• Dell SARemediation plugin folder (C:\Program Files\Dell\SARemediation\plugin\log.dll) is known to contain the 'log.dll' file.
• The Canon MyPrinter folder 'C:\Program Files\Canon\MyPrinter\' is known to contain the 'log.dll' file

Tags

• attack.persistence
• attack.privilege-escalation
• attack.execution
• attack.stealth
• attack.t1574.001

MITRE ATT&CK ids this rule names

• T1574.001

References

• https://hijacklibs.net/
• https://www.huntress.com/blog/clickfix-matanbuchus-astarionrat-analysis

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_side_load_antivirus.yml