Sigma rule: Potential DLL Sideloading Via comctl32.dll

Rule

Title

Potential DLL Sideloading Via comctl32.dll

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash)

Date

2022-12-16

Modified

2022-12-19

File

rules/windows/image_load/image_load_side_load_comctl32.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Log source

product

windows

category

image_load

Detection

selection:
    ImageLoaded|startswith:
        - 'C:\Windows\System32\logonUI.exe.local\'
        - 'C:\Windows\System32\werFault.exe.local\'
        - 'C:\Windows\System32\consent.exe.local\'
        - 'C:\Windows\System32\narrator.exe.local\'
        - 'C:\windows\system32\wermgr.exe.local\'
    ImageLoaded|endswith: '\comctl32.dll'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.persistence
• attack.privilege-escalation
• attack.execution
• attack.stealth
• attack.t1574.001

MITRE ATT&CK ids this rule names

• T1574.001

References

• https://github.com/binderlabs/DirCreate2System
• https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_side_load_comctl32.yml