Hijack Execution Flow detection rulesT1574

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

windows · process_creation

Detects the use of SharpUp, a tool for local privilege escalation

windows · process_creation

Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities

windows · process_creation

Detects specific process characteristics of Winnti Pipemon malware reported by ESET

windows · process_creation

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

windows · process_creation

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

windows · ps_script

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

windows · image_load

Detects the ld.so preload persistence file. See `man ld.so` for more information.

linux

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

windows · registry_set

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

windows

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

windows

Detects DLL sideloading activity seen used by Diamond Sleet APT

windows · image_load

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

windows · file_event

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

windows · process_creation

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

windows · image_load

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

windows

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

windows · process_creation

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

windows · image_load

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

windows · file_event

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

windows · image_load

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded

windows · file_event

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL

windows

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

windows · image_load

Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.

linux

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

windows · registry_set

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

windows · process_creation

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

windows · process_creation

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

windows · image_load

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

windows · file_event

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

windows · process_creation

Detects potential DLL sideloading of "appverifUI.dll"

windows · image_load

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

windows · image_load

Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.

windows · image_load

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

windows · image_load

Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL

windows · image_load

Detects potential DLL sideloading of "EACore.dll"

windows · image_load

Detects potential DLL sideloading of "edputil.dll"

windows · image_load

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

windows · image_load

Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes.

windows · image_load

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

windows · image_load

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

windows · process_creation

Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.

windows · process_creation

Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location

windows · process_creation

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

windows · file_delete

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

windows · process_creation

Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.

windows · image_load

Detects potential DLL sideloading of rcdll.dll

windows · image_load

Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

windows · image_load

Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

windows · image_load

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

windows · image_load

Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library. Threat actors have been observed using DLL sideloading techniques to load malicious payloads under the guise of legitimate applications such as SqlWriter, SqlDumper etc. Notably, APT29 has been documented leveraging WinELOADER to sideload vcruntime140.dll for executing malicious code.

windows · image_load

Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

windows · image_load

Detects registry modifications related to 'OracleOciLib' and 'OracleOciLibPath' under 'MSDTC' settings. Threat actors may modify these registry keys to redirect the loading of 'oci.dll' to a malicious DLL, facilitating phantom DLL hijacking via the MSDTC service.

windows · registry_set

Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

windows · process_creation

Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.

windows · process_creation

Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.

windows · process_creation

Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks

windows · process_creation

Detects a suspicious printer driver installation with an empty Manufacturer value

windows · registry_set

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

windows · ps_script

Detects loading and execution of an unsigned thor scanner binary.

windows · image_load

Detects image load events of system control panel items (.cpl) from uncommon or non-system locations that may indicate DLL sideloading or other abuse techniques.

windows · image_load

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

windows · process_creation

Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.

windows · image_load

Attempts to load dismcore.dll after dropping it

windows · image_load

Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations

windows

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

windows · image_load

Detects using SettingSyncHost.exe to run hijacked binary

windows · process_creation

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

windows · image_load

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

windows · process_creation

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

windows · process_creation

Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs. Thus, the creation of such DLLs may indicate preparation for phantom DLL hijacking attacks.

windows · file_event

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

windows · file_event

Detects using register-cimprovider.exe to execute arbitrary dll file.

windows · process_creation

Hunts known SVR-specific DLL names.

windows · image_load

Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.

windows · registry_set

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

windows · image_load

Detects potential DLL sideloading of "AVKkid.dll"

windows · image_load

Detects potential DLL sideloading of "CCleanerDU.dll"

windows · image_load

Detects potential DLL sideloading of "CCleanerReactivator.dll"

windows · image_load

Detects potential DLL sideloading of "chrome_frame_helper.dll"

windows · image_load

Detects DLL sideloading of "dbgcore.dll"

windows · image_load

Detects potential DLL sideloading of "dbghelp.dll"

windows · image_load

Detects potential DLL sideloading of "DbgModel.dll"

windows · image_load

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

windows · image_load

Detects potential DLL sideloading of "MpSvc.dll".

windows · image_load

Detects potential DLL sideloading of "mscorsvc.dll".

windows · image_load

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

windows · image_load

Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

windows · process_creation

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

windows · image_load

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

windows · image_load

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

windows · file_event

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

windows · image_load

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

windows · image_load

Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.

windows · process_creation

Detects potential DLL sideloading of Python DLL files.

windows · image_load

Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes

windows · registry_set

Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

windows · image_load

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

windows · image_load

Detects potential DLL sideloading of "ShellDispatch.dll"

windows · image_load

Detects potential DLL sideloading of "SolidPDFCreator.dll"

windows · image_load

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

windows · process_creation

Detects potential DLL sideloading of "vivaldi_elf.dll"

windows · image_load

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

windows · image_load

Detects potential DLL sideloading of "wwlib.dll"

windows · image_load

Detects potentially suspicious child processes of KeyScrambler.exe

windows · process_creation

Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR. (Citation: Microsoft Profiling Mar 2017) (Citation: Microsoft COR_PROFILER Feb 2013)

windows · ps_script

Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.

windows · process_creation

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

windows · ps_script

Detection of sc.exe utility adding a new service with special permission which hides that service.

windows · process_creation

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility.

windows · process_creation

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

windows · image_load

Detects the loading of unsigned .node files. Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack. .node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code. This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications.

windows · image_load

Detects unsigned module load by ClickOnce application.

windows · image_load

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

windows · image_load

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

windows · image_load

Detects potential DLL sideloading of "7za.dll"

windows · image_load

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.

windows · image_load

Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.

windows

Detects the loading of a digitally signed DLL whose PE version-info resource is entirely missing. Legitimate signed DLLs from reputable vendors often carry populated metadata fields (Description, Company, Product, OriginalFileName, FileVersion). An attacker who signs a purpose-built or hollowed DLL with a stolen, mis-issued, or cheaply purchased code-signing certificate will often omit these fields, producing a valid signature with no accompanying version info. This pattern is observed in DLL side-loading, search-order hijacking, and certificate-abuse campaigns where signing is used purely to satisfy security-product trust checks. Hunting Hypothesis: - Investigate the signing certificate (issuer, subject, validity window, thumbprint) for disposable or recently issued CAs and cross-reference against known threat-actor certificates. - Examine the DLL's on-disk path relative to the loading process — paths outside standard system directories or inside application folders susceptible to search-order hijacking are high-priority leads. - Correlate with the parent process context; DLLs loaded into high-value targets such as lsass.exe, svchost.exe, or browser processes warrant immediate escalation. Note: The "selection_metadata_null" selection matches fields with a null value. Some backends may interpret null field conditions as "field does not exist" rather than "field has a null value", which would change the detection semantics. If your backend does not support or support null-value matching in different ways than expected, you may need to adjust the rule logic accordingly or remove the "selection_metadata_null" condition.

windows · image_load

Detects calls to hidden files or files located in hidden directories in NIX systems.

linux

Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).

windows · image_load