attack.t1574.001

APT27 - Emissary Panda Activity

May 15, 2025 · attack.defense-evasion attack.t1574.001 attack.g0027 detection.emerging-threats ·

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

Aruba Network Service Potential DLL Sideloading

May 15, 2025 · attack.privilege-escalation attack.persistence attack.t1574.001 ·

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

Creation Of Non-Existent System DLL

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). Usually this technique is used to achieve DLL hijacking.

DHCP Callout DLL Installation

May 15, 2025 · attack.defense-evasion attack.t1574.001 attack.t1112 ·

Share on:

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

DHCP Server Error Failed Loading the CallOut DLL

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

DHCP Server Loaded the CallOut DLL

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

Diamond Sleet APT DLL Sideloading Indicators

May 15, 2025 · attack.defense-evasion attack.t1574.001 detection.emerging-threats ·

Share on:

Detects DLL sideloading activity seen used by Diamond Sleet APT

DLL Names Used By SVR For GraphicalProton Backdoor

May 15, 2025 · attack.defense-evasion attack.t1574.001 detection.emerging-threats ·

Share on:

Hunts known SVR-specific DLL names.

DLL Search Order Hijackig Via Additional Space in Path

May 15, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·

Share on:

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

DLL Sideloading by VMware Xfer Utility

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

DLL Sideloading Of ShellChromeAPI.DLL

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

DNS Server Error Failed Loading the ServerLevelPluginDLL

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

Fax Service DLL Search Order Hijack

May 15, 2025 · attack.persistence attack.defense-evasion attack.t1574.001 ·

Share on:

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

Lazarus APT DLL Sideloading Activity

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.g0032 detection.emerging-threats ·

Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Malicious DLL File Dropped in the Teams or OneDrive Folder

May 15, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·

Share on:

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded

Microsoft Defender Blocked from Loading Unsigned DLL

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL

Microsoft Office DLL Sideload

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

New DNS ServerLevelPluginDll Installed

May 15, 2025 · attack.defense-evasion attack.t1574.001 attack.t1112 ·

Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE

May 15, 2025 · attack.defense-evasion attack.t1574.001 attack.t1112 ·

Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Potential 7za.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "7za.dll"

Potential Antivirus Software DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Potential appverifUI.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "appverifUI.dll"

Potential AVKkid.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "AVKkid.dll"

Potential Azure Browser SSO Abuse

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.

Potential CCleanerDU.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "CCleanerDU.dll"

Potential CCleanerReactivator.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "CCleanerReactivator.dll"

Potential Chrome Frame Helper DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "chrome_frame_helper.dll"

Potential DLL Sideloading Of DBGCORE.DLL

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects DLL sideloading of "dbgcore.dll"

Potential DLL Sideloading Of DBGHELP.DLL

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "dbghelp.dll"

Potential DLL Sideloading Of DbgModel.DLL

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "DbgModel.dll"

Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Potential DLL Sideloading Of MpSvc.DLL

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "MpSvc.dll".

Potential DLL Sideloading Of MsCorSvc.DLL

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "mscorsvc.dll".

Potential DLL Sideloading Of Non-Existent DLLs From System Folders

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects DLL sideloading of system DLLs that are not present on the system by default (at least not in system directories). Usually this technique is used to achieve UAC bypass or privilege escalation.

Potential DLL Sideloading Via ClassicExplorer32.dll

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Potential DLL Sideloading Via comctl32.dll

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Potential DLL Sideloading Via DeviceEnroller.EXE

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Potential DLL Sideloading Via JsSchHlp

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Potential DLL Sideloading Via VMware Xfer

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL

Potential EACore.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "EACore.dll"

Potential Edputil.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "edputil.dll"

Potential Goopdate.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

Potential Iviewers.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Potential Libvlc.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

Potential Mfdetours.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Potential Mpclient.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Potential Mpclient.DLL Sideloading Via Defender Binaries

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Potential PlugX Activity

May 15, 2025 · attack.s0013 attack.defense-evasion attack.t1574.001 detection.emerging-threats ·

Share on:

Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location

Potential Python DLL SideLoading

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of Python DLL files.

Potential Raspberry Robin Aclui Dll SideLoading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 detection.emerging-threats ·

Share on:

Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.

Potential Rcdll.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of rcdll.dll

Potential RjvPlatform.DLL Sideloading From Default Location

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

Potential RjvPlatform.DLL Sideloading From Non-Default Location

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

Potential RoboForm.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Potential ShellDispatch.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "ShellDispatch.dll"

Potential SmadHook.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Potential SolidPDFCreator.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "SolidPDFCreator.dll"

Potential System DLL Sideloading From Non System Locations

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

Potential Vivaldi_elf.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "vivaldi_elf.dll"

Potential Waveedit.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

Potential Wazuh Security Platform DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Potential WWlib.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of "wwlib.dll"

Potentially Suspicious Child Process of KeyScrambler.exe

May 15, 2025 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1203 attack.t1574.001 ·

Share on:

Detects potentially suspicious child processes of KeyScrambler.exe

Renamed Vmnat.exe Execution

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

Suspicious GUP Usage

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks

Suspicious Unsigned Thor Scanner Execution

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects loading and execution of an unsigned thor scanner binary.

Tasks Folder Evasion

May 15, 2025 · attack.defense-evasion attack.persistence attack.execution attack.t1574.001 ·

Share on:

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

Third Party Software DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

UAC Bypass With Fake DLL

May 15, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1574.001 ·

Share on:

Attempts to load dismcore.dll after dropping it

Unsigned Binary Loaded From Suspicious Location

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations

Unsigned Mfdetours.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Unsigned Module Loaded by ClickOnce Application

May 15, 2025 · attack.persistence attack.t1574.001 ·

Share on:

Detects unsigned module load by ClickOnce application.

VMGuestLib DLL Sideload

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

VMMap Signed Dbghelp.DLL Potential Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

VMMap Unsigned Dbghelp.DLL Potential Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·

Share on:

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

Winnti Malware HK University Campaign

May 15, 2025 · attack.defense-evasion attack.t1574.001 attack.g0044 detection.emerging-threats ·

Share on:

Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities

Winnti Pipemon Characteristics

May 15, 2025 · attack.defense-evasion attack.t1574.001 attack.g0044 detection.emerging-threats ·

Share on:

Detects specific process characteristics of Winnti Pipemon malware reported by ESET

Xwizard.EXE Execution From Non-Default Location

May 15, 2025 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

Creation of WerFault.exe/Wer.dll in Unusual Folder

Nov 29, 2024 · attack.persistence attack.defense-evasion attack.t1574.001 ·

Share on:

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

HackTool - Powerup Write Hijack DLL

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·

Share on:

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

Pingback Backdoor Activity

Aug 12, 2024 · attack.persistence attack.t1574.001 detection.emerging-threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Pingback Backdoor DLL Loading Activity

Aug 12, 2024 · attack.persistence attack.t1574.001 detection.emerging-threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Pingback Backdoor File Indicators

Aug 12, 2024 · attack.persistence attack.t1574.001 detection.emerging-threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Potential Initial Access via DLL Search Order Hijacking

Aug 12, 2024 · attack.t1566 attack.t1566.001 attack.initial-access attack.t1574 attack.t1574.001 attack.defense-evasion ·

Share on:

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Small Sieve Malware CommandLine Indicator

Aug 12, 2024 · attack.persistence attack.t1574.001 detection.emerging-threats ·

Share on:

Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.

Use Of Hidden Paths Or Files

Aug 12, 2024 · attack.defense-evasion attack.t1574.001 ·

Share on:

Detects calls to hidden files or files located in hidden directories in NIX systems.

Shrpubw Execution from Unexpected File Path

Sep 1, 2023 · attack.persistence attack.t1574 attack.t1574.001 ·

Share on:

Looks for the execution of svchost without the normal -k parameter. Inspired by the 2022 Red Canary Threat Detection report.