Sigma rule: Potential DLL Sideloading Via JsSchHlp

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-332d435484e5, updated 2022-12-14T00:00:00.000Z.

Rule

Title: Potential DLL Sideloading Via JsSchHlp
Status: test
Level: medium
Author: frack113
Date: 2022-12-14
File: rules/windows/image_load/image_load_side_load_jsschhlp.yml
Commit: ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Log source

product: windows
category: image_load

Detection

selection:
    ImageLoaded|endswith: '\JSESPR.dll'
filter:
    ImageLoaded|startswith: 'C:\Program Files\Common Files\Justsystem\JsSchHlp\'
condition: selection and not filter

False positives (as the rule lists them)

Unknown

MITRE ATT&CK ids this rule names

T1574.001

References

https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/
http://www.windowexe.com/bbs/board.php?q=jsschhlp-exe-c-program-files-common-files-justsystem-jsschhlp-jsschhlp

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_side_load_jsschhlp.yml

Sources and licences

SigmaHQ
"Potential DLL Sideloading Via JsSchHlp" by frack113 (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_side_load_jsschhlp.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Potential DLL Sideloading Via JsSchHlp",
entity page, dataset version ref-332d435484e5, updated 2022-12-14T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/68654bf0-4412-43d5-bfe8-5eaa393cd939 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 68654bf0-4412-43d5-bfe8-5eaa393cd939, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.