Detection: Windows Known Abused DLL Loaded Suspiciously

Updated Date: 2026-09-22 ID: dd6d1f16-adc0-4e87-9c34-06189516b803 Author: Steven Dick Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects when DLLs with known abuse history are loaded from an unusual location. This activity may represent an attacker performing a DLL search order or sideload hijacking technique. These techniques are used to gain persistence as well as elevate privileges on the target system.

Search

  1`sysmon`
  2ImageLoaded
  3EventCode=7
  4
  5NOT ImageLoaded IN (
  6    "C:\\$WINDOWS.~BT\\*",
  7    "C:\\$WinREAgent\\*",
  8    "C:\\Windows\\SoftwareDistribution\\*",
  9    "C:\\Windows\\SyChpe32\\*",
 10    "C:\\Windows\\System32\\*",
 11    "C:\\Windows\\SystemTemp\\*",
 12    "C:\\Windows\\SysWOW64\\*",
 13    "C:\\Windows\\WinSxS\\*"
 14)
 15
 16NOT (
 17    ImageLoaded="C:\\Windows\\Temp\\*"
 18    Image IN (
 19        "C:\\Windows\\WinSxS\\arm64*",
 20        "C:\\Windows\\UUS\\arm64\\*"
 21    )
 22    Image IN (
 23        "*\\TiWorker.exe",
 24        "*\\wuaucltcore.exe"
 25    )
 26)
 27
 28NOT (
 29    ImageLoaded="C:\\Windows\\Microsoft.NET\\*"
 30    ImageLoaded="*\\cscui.dll"
 31)
 32
 33NOT (
 34    ImageLoaded="C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*"
 35    ImageLoaded="*\\version.dll"
 36)
 37
 38NOT (
 39    ImageLoaded="C:\\Program Files\\WindowsApps\\Microsoft.DirectXRuntime_*"
 40    ImageLoaded="*\\d3dx9_43.dll"
 41)
 42
 43NOT ImageLoaded="C:\\Windows\\ImmersiveControlPanel\\SystemSettings.dll"
 44
 45NOT (
 46    ImageLoaded="C:\\Program Files\\Microsoft\\Exchange Server\\*"
 47    ImageLoaded="*\\mswb7.dll"
 48)
 49
 50NOT (
 51    ImageLoaded="C:\\Program Files\\Arsenal-Image-Mounter-*"
 52    ImageLoaded IN (
 53        "*\\mi.dll",
 54        "*\\miutils.dll"
 55    )
 56)
 57
 58NOT (
 59    Image="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe"
 60    ImageLoaded="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll"
 61)
 62
 63NOT ImageLoaded="C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\*"
 64
 65NOT (
 66    Image IN (
 67        "C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*",
 68        "C:\\Windows\\System32\\backgroundTaskHost.exe"
 69    )
 70    ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*"
 71)
 72
 73NOT (
 74    ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs\\*"
 75    ImageLoaded="*\\wldp.dll"
 76)
 77
 78NOT (
 79    Image IN (
 80        "C:\\Program Files\\CheckPoint\\*",
 81        "C:\\Program Files (x86)\\CheckPoint\\*"
 82    )
 83    Image="*\\SmartConsole.exe"
 84    ImageLoaded IN (
 85        "C:\\Program Files\\CheckPoint\\*",
 86        "C:\\Program Files (x86)\\CheckPoint\\*"
 87    )
 88    ImageLoaded="*\\PolicyManager.dll"
 89)
 90
 91
 92| lookup local=t hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as reference
 93
 94| lookup local=t hijacklibs_loaded library AS loaded_file excludes AS loaded_file_path OUTPUT islibrary AS excluded
 95
 96| where islibrary="TRUE" AND excluded="false"
 97
 98
 99| stats count min(_time) as firstTime
100              max(_time) as lastTime
101
102  by dest loaded_file loaded_file_path process_exec
103     process_guid process_hash process_id process_name
104     process_path service_dll_signature_exists
105     service_dll_signature_verified signature
106     signature_id user user_id reference vendor_product
107
108
109| `security_content_ctime(firstTime)`
110
111| `security_content_ctime(lastTime)`
112
113| `windows_known_abused_dll_loaded_suspiciously_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 7	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
sysmon	`(source=WinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational)`
windows_known_abused_dll_loaded_suspiciously_filter	`search *`

windows_known_abused_dll_loaded_suspiciously_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1574.001	DLL	Execution

Exploitation

Installation

DE.CM

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

The following analytic requires Sysmon operational logs to be ingested, with EventID 7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index.

Known False Positives

False positives are expected from third party applications and other legitimate system processes located in Program Files and other similar locations. Filter as needed.

Associated Analytic Story

Finding

Title	Entity Field	Entity Type	Risk Score
The module [$loaded_file$] was loaded from an unusual location [$loaded_file_path$] on [$dest$]. Which may indicate a DLL search order or sideload hijacking technique.	dest	system	50

Threat Objects

Field	Type
loaded_file_path	file_path
process_path	file_path

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 13