Potential Iviewers.DLL Sideloading

calendar May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001  ·
Share on: linkedin copy

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Sigma rule (View on GitHub)

 1title: Potential Iviewers.DLL Sideloading
 2id: 4c21b805-4dd7-469f-b47d-7383a8fcb437
 3status: test
 4description: Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)
 5references:
 6    - https://www.secureworks.com/research/shadowpad-malware-analysis
 7author: X__Junior (Nextron Systems)
 8date: 2023-03-21
 9tags:
10    - attack.defense-evasion
11    - attack.privilege-escalation
12    - attack.t1574.001
13logsource:
14    category: image_load
15    product: windows
16detection:
17    selection:
18        ImageLoaded|endswith: '\iviewers.dll'
19    filter:
20        ImageLoaded|startswith:
21            - 'C:\Program Files (x86)\Windows Kits\'
22            - 'C:\Program Files\Windows Kits\'
23    condition: selection and not filter
24falsepositives:
25    - Unknown
26level: high

References

  • ShadowPad Malware Analysis

    In this threat analysis, ShadowPad samples reveals clusters of activity linked to threat groups affiliated with the Chinese Ministry of State Security (MSS) civilian intelligence agency and the People's Liberation Army (PLA).


    Read More

Related rules

to-top