Unsigned DLL Side-Loading from a Suspicious Folder
ELASTIC detection rule by Elastic · Elastic License v2
Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted
program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading a
malicious DLL within the memory space of a signed processes.
[metadata]
creation_date = "2022/11/22"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/05/04"
[rule]
author = ["Elastic"]
description = """
Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted
program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading a
malicious DLL within the memory space of a signed processes.
"""
from = "now-9m"
index = ["logs-endpoint.events.library-*"]
language = "eql"
license = "Elastic License v2"
name = "Unsigned DLL Side-Loading from a Suspicious Folder"
note = """## Triage and analysis
> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
### Investigating Unsigned DLL Side-Loading from a Suspicious Folder
DLL side-loading exploits the trust of signed executables to load malicious DLLs, often from suspicious directories. Adversaries use this to bypass security measures by placing unsigned DLLs in locations mimicking legitimate paths. The detection rule identifies this by checking for trusted programs loading recently modified, unsigned DLLs from atypical directories, signaling potential evasion tactics.
### Possible investigation steps
- Review the process code signature to confirm the legitimacy of the trusted program that loaded the DLL. Check if the process is expected to run from the identified directory.
- Examine the DLL's path and creation or modification time to determine if it aligns with typical user or system activity. Investigate why the DLL was recently modified or created.
- Analyze the DLL's code signature status to understand why it is unsigned or has an error status. This can help identify if the DLL is potentially malicious.
- Investigate the parent process and any associated child processes to understand the context of the DLL loading event. This can provide insights into how the DLL was introduced.
- Check for any recent changes or anomalies in the system or user activity logs around the time the DLL was created or modified to identify potential indicators of compromise.
- Correlate the alert with other security events or alerts in the environment to determine if this is part of a broader attack or isolated incident.
### False positive analysis
- Legitimate software updates or installations may temporarily load unsigned DLLs from atypical directories. Users can create exceptions for known update processes by verifying the source and ensuring the process is part of a legitimate update.
- Custom or in-house applications might load unsigned DLLs from non-standard directories. Users should verify the application's behavior and, if deemed safe, exclude these specific paths or processes from the rule.
- Development environments often involve testing unsigned DLLs in various directories. Developers can exclude these environments by specifying the directories or processes involved in the development workflow.
- Some third-party security or system management tools may use unsigned DLLs for legitimate purposes. Users should confirm the tool's legitimacy and add exceptions for these tools to prevent false positives.
### Response and remediation
- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any malicious activity.
- Terminate the process associated with the unsigned DLL to stop any ongoing malicious operations.
- Quarantine the suspicious DLL file and any related files for further analysis to understand the scope and nature of the threat.
- Conduct a thorough scan of the affected system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malicious files or remnants.
- Review and restore any altered system configurations or settings to their original state to ensure system integrity.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if the threat has impacted other systems.
- Implement additional monitoring and logging on the affected system and network to detect any recurrence or similar threats in the future."""
references = [
"https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
risk_score = 47
rule_id = "ca98c7cf-a56e-4057-a4e8-39603f7f0389"
setup = """## Setup
This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
Setup instructions: https://ela.st/install-elastic-defend
"""
severity = "medium"
tags = [
"Domain: Endpoint",
"OS: Windows",
"Use Case: Threat Detection",
"Tactic: Defense Evasion",
"Data Source: Elastic Defend",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
library where host.os.type == "windows" and
process.code_signature.trusted == true and
(dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and
not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*", "errorChaining") and
/* Suspicious Paths */
dll.path : ("?:\\PerfLogs\\*.dll",
"?:\\Users\\*\\Pictures\\*.dll",
"?:\\Users\\*\\Music\\*.dll",
"?:\\Users\\Public\\*.dll",
"?:\\Users\\*\\Documents\\*.dll",
"?:\\Users\\*\\Downloads\\*.dll",
"?:\\Windows\\Tasks\\*.dll",
"?:\\Windows\\System32\\Tasks\\*.dll",
"?:\\Intel\\*.dll",
"?:\\AMD\\Temp\\*.dll",
"?:\\Windows\\AppReadiness\\*.dll",
"?:\\Windows\\ServiceState\\*.dll",
"?:\\Windows\\security\\*.dll",
"?:\\Windows\\System\\*.dll",
"?:\\Windows\\IdentityCRL\\*.dll",
"?:\\Windows\\Branding\\*.dll",
"?:\\Windows\\csc\\*.dll",
"?:\\Windows\\DigitalLocker\\*.dll",
"?:\\Windows\\en-US\\*.dll",
"?:\\Windows\\wlansvc\\*.dll",
"?:\\Windows\\Prefetch\\*.dll",
"?:\\Windows\\Fonts\\*.dll",
"?:\\Windows\\diagnostics\\*.dll",
"?:\\Windows\\TAPI\\*.dll",
"?:\\Windows\\INF\\*.dll",
"?:\\windows\\tracing\\*.dll",
"?:\\windows\\IME\\*.dll",
"?:\\Windows\\Performance\\*.dll",
"?:\\windows\\intel\\*.dll",
"?:\\windows\\ms\\*.dll",
"?:\\Windows\\dot3svc\\*.dll",
"?:\\Windows\\ServiceProfiles\\*.dll",
"?:\\Windows\\panther\\*.dll",
"?:\\Windows\\RemotePackages\\*.dll",
"?:\\Windows\\OCR\\*.dll",
"?:\\Windows\\appcompat\\*.dll",
"?:\\Windows\\apppatch\\*.dll",
"?:\\Windows\\addins\\*.dll",
"?:\\Windows\\Setup\\*.dll",
"?:\\Windows\\Help\\*.dll",
"?:\\Windows\\SKB\\*.dll",
"?:\\Windows\\Vss\\*.dll",
"?:\\Windows\\Web\\*.dll",
"?:\\Windows\\servicing\\*.dll",
"?:\\Windows\\CbsTemp\\*.dll",
"?:\\Windows\\Logs\\*.dll",
"?:\\Windows\\WaaS\\*.dll",
"?:\\Windows\\twain_32\\*.dll",
"?:\\Windows\\ShellExperiences\\*.dll",
"?:\\Windows\\ShellComponents\\*.dll",
"?:\\Windows\\PLA\\*.dll",
"?:\\Windows\\Migration\\*.dll",
"?:\\Windows\\debug\\*.dll",
"?:\\Windows\\Cursors\\*.dll",
"?:\\Windows\\Containers\\*.dll",
"?:\\Windows\\Boot\\*.dll",
"?:\\Windows\\bcastdvr\\*.dll",
"?:\\Windows\\TextInput\\*.dll",
"?:\\Windows\\schemas\\*.dll",
"?:\\Windows\\SchCache\\*.dll",
"?:\\Windows\\Resources\\*.dll",
"?:\\Windows\\rescache\\*.dll",
"?:\\Windows\\Provisioning\\*.dll",
"?:\\Windows\\PrintDialog\\*.dll",
"?:\\Windows\\PolicyDefinitions\\*.dll",
"?:\\Windows\\media\\*.dll",
"?:\\Windows\\Globalization\\*.dll",
"?:\\Windows\\L2Schemas\\*.dll",
"?:\\Windows\\LiveKernelReports\\*.dll",
"?:\\Windows\\ModemLogs\\*.dll",
"?:\\Windows\\ImmersiveControlPanel\\*.dll",
"?:\\$Recycle.Bin\\*.dll") and
/* DLL loaded from the process.executable current directory */
(endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1))) or dll.name : "chrome_elf.dll")
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[rule.threat.technique.subtechnique]]
id = "T1036.001"
name = "Invalid Code Signature"
reference = "https://attack.mitre.org/techniques/T1036/001/"
[[rule.threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[rule.threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"