Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

Detects potential DLL sideloading of "wwlib.dll"

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.)

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Detects potential DLL sideloading of "chrome_frame_helper.dll"

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Detects potential DLL sideloading of "SolidPDFCreator.dll"

Detects DLL sideloading of "dbgcore.dll"

Detects DLL sideloading of "dbghelp.dll"

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Detects potential DLL sideloading of rcdll.dll

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks

Detects execution of Microsoft Defender's CLI process (MpCmdRun.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL

Detects the creation of system dlls that are not present on the system. Usually to achieve dll hijacking

Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation

Detects DLL sideloading of DLLs that are loaded by the SCM for some services (IKE, IKEEXT, SessionEnv) which do not exists on a typical modern system IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default. An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a remote machine.

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

Detects loading of Microsoft Defender's DLLs by its processes (MpCmdRun and NisSrv) from the non-default directory which may be an attempt to sideload arbitrary DLL

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations

Detects the execution of Xwizard tool from the non-default directory which can be used to sideload a custom xwizards.dll

Attempts to load dismcore.dll after dropping it

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file (“iphlpapi.dll”) is sideloaded

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL