Potential Antivirus Software DLL Sideloading

  1title: Potential Antivirus Software DLL Sideloading
  2id: 552b6b65-df37-4d3e-a258-f2fc4771ae54
  3status: test
  4description: Detects potential DLL sideloading of DLLs that are part of antivirus software such as McAfee, Symantec...etc
  5references:
  6    - https://hijacklibs.net/ # For list of DLLs that could be sideloaded (search for dlls mentioned here in there)
  7    - https://www.huntress.com/blog/clickfix-matanbuchus-astarionrat-analysis
  8author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
  9date: 2022-08-17
 10modified: 2026-10-19
 11tags:
 12    - attack.persistence
 13    - attack.privilege-escalation
 14    - attack.execution
 15    - attack.stealth
 16    - attack.t1574.001
 17logsource:
 18    category: image_load
 19    product: windows
 20detection:
 21    # Bitdefender
 22    selection_bitdefender:
 23        ImageLoaded|endswith: '\log.dll'
 24    filter_log_dll_bitdefender:
 25        ImageLoaded|startswith:
 26            - 'C:\Program Files\Bitdefender Antivirus Free\'
 27            - 'C:\Program Files (x86)\Bitdefender Antivirus Free\'
 28    filter_log_dll_dell_sar:
 29        Image: 'C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe'
 30        ImageLoaded:
 31            - 'C:\Program Files\Dell\SARemediation\plugin\log.dll'
 32            - 'C:\Program Files\Dell\SARemediation\audit\log.dll'
 33    filter_log_dll_canon:
 34        ImageLoaded|startswith: 'C:\Program Files\Canon\MyPrinter\'
 35    filter_log_dll_avast:
 36        ImageLoaded:
 37            - 'C:\Program Files\AVAST Software\Avast\log.dll'
 38            - 'C:\Program Files (x86)\AVAST Software\Avast\log.dll'
 39    filter_log_dll_avg:
 40        ImageLoaded:
 41            - 'C:\Program Files\AVG\Antivirus\log.dll'
 42            - 'C:\Program Files (x86)\AVG\Antivirus\log.dll'
 43    # F-Secure
 44    selection_fsecure:
 45        ImageLoaded|endswith: '\qrt.dll'
 46    filter_fsecure:
 47        ImageLoaded|startswith:
 48            - 'C:\Program Files\F-Secure\Anti-Virus\'
 49            - 'C:\Program Files (x86)\F-Secure\Anti-Virus\'
 50    # McAfee
 51    selection_mcafee:
 52        ImageLoaded|endswith:
 53            - '\ashldres.dll'
 54            - '\lockdown.dll'
 55            - '\vsodscpl.dll'
 56    filter_mcafee:
 57        ImageLoaded|startswith:
 58            - 'C:\Program Files\McAfee\'
 59            - 'C:\Program Files (x86)\McAfee\'
 60    # CyberArk
 61    selection_cyberark:
 62        ImageLoaded|endswith: '\vftrace.dll'
 63    filter_cyberark:
 64        ImageLoaded|startswith:
 65            - 'C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\'
 66            - 'C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32\'
 67    # Avast
 68    selection_avast:
 69        ImageLoaded|endswith: '\wsc.dll'
 70    filter_wsc_dll_avast:
 71        ImageLoaded|startswith:
 72            - 'C:\Program Files\AVAST Software\Avast\'
 73            - 'C:\Program Files (x86)\AVAST Software\Avast\'
 74    filter_wsc_dll_avg:
 75        ImageLoaded|startswith:
 76            - 'C:\Program Files\AVG\Antivirus\'
 77            - 'C:\Program Files (x86)\AVG\Antivirus\'
 78    # ESET
 79    selection_eset_deslock:
 80        ImageLoaded|endswith: '\DLPPREM32.dll'
 81    filter_eset_deslock:
 82        ImageLoaded|startswith:
 83            - 'C:\Program Files\ESET'
 84            - 'C:\Program Files (x86)\ESET'
 85    # Trend Micro Titanium
 86    selection_titanium:
 87        ImageLoaded|endswith: '\tmdbglog.dll'
 88    filter_titanium:
 89        ImageLoaded|startswith:
 90            - 'C:\Program Files\Trend Micro\Titanium\'
 91            - 'C:\Program Files (x86)\Trend Micro\Titanium\'
 92    # Zillya Antivirus
 93    selection_zillya:
 94        ImageLoaded|endswith: '\SystemStatus.dll'
 95    filter_zillya_ovron:
 96        ImageLoaded|startswith:
 97            - 'C:\Program Files\Zillya Antivirus\'
 98            - 'C:\Program Files (x86)\Zillya Antivirus\'
 99            - 'C:\Program Files\Zillya Total Security\'
100            - 'C:\Program Files (x86)\Zillya Total Security\'
101            - 'C:\Program Files\Ovron Total Security\'
102            - 'C:\Program Files (x86)\Ovron Total Security\'
103    condition: (selection_bitdefender and not 1 of filter_log_dll_*)
104               or (selection_fsecure and not filter_fsecure)
105               or (selection_mcafee and not filter_mcafee)
106               or (selection_cyberark and not filter_cyberark)
107               or (selection_avast and not 1 of filter_wsc_dll_*)
108               or (selection_titanium and not filter_titanium)
109               or (selection_eset_deslock and not filter_eset_deslock)
110               or (selection_zillya and not filter_zillya_ovron)
111falsepositives:
112    - Applications that load the same dlls mentioned in the detection section. Investigate them and filter them out if a lot FPs are caused.
113    - Dell SARemediation plugin folder (C:\Program Files\Dell\SARemediation\plugin\log.dll) is known to contain the 'log.dll' file.
114    - The Canon MyPrinter folder 'C:\Program Files\Canon\MyPrinter\' is known to contain the 'log.dll' file
115level: medium