Sigma rule: Third Party Software DLL Sideloading

Rule

Title

Third Party Software DLL Sideloading

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)

Date

2022-08-17

File

rules/windows/image_load/image_load_side_load_third_party.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Log source

product

windows

category

image_load

Detection

# Lenovo
selection_lenovo:
    ImageLoaded|endswith: '\commfunc.dll'
filter_lenovo:
    - ImageLoaded|contains: '\AppData\local\Google\Chrome\Application\'
    - ImageLoaded|startswith:
          - 'C:\Program Files\Lenovo\Communications Utility\'
          - 'C:\Program Files (x86)\Lenovo\Communications Utility\'
# Toshiba
selection_toshiba:
    ImageLoaded|endswith: '\tosbtkbd.dll'
filter_toshiba:
    ImageLoaded|startswith:
        - 'C:\Program Files\Toshiba\Bluetooth Toshiba Stack\'
        - 'C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\'
# Zoom (FP with System32)
# selection_zoom:
#     ImageLoaded|endswith: '\version.dll'
# filter_zoom:
#     ImageLoaded|startswith: 'C:\Users\'
#     ImageLoaded|contains: '\AppData\Roaming\Zoom\bin\'
condition: (selection_lenovo and not filter_lenovo) or (selection_toshiba and not filter_toshiba)

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.privilege-escalation
• attack.execution
• attack.stealth
• attack.t1574.001

MITRE ATT&CK ids this rule names

• T1574.001

References

• https://hijacklibs.net/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_side_load_third_party.yml