Defender-DeviceImageLoadEvents

ActionType	Title	Sample	Rule
any	Image load	Y	Y
ImageLoaded	Image loaded	Y	Y

any: Image load

Table: DeviceImageLoadEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ActionType`
`FileName`
`FolderPath`
`SHA256`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ImageLoaded",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "rpcMessages.dll",
  "FileSize": 163328,
  "FileSize@odata.type": "#Int64",
  "FolderPath": "C:\\Windows\\System32\\rpcMessages.dll",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "\"OneDriveStandaloneUpdater.exe\" /reporting",
  "InitiatingProcessCreationTime": "2026-08-01T09:03:46.8776437Z",
  "InitiatingProcessFileName": "onedrivestandaloneupdater.exe",
  "InitiatingProcessFileSize": 4407184,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\program files\\microsoft onedrive\\onedrivestandaloneupdater.exe",
  "InitiatingProcessId": 4116,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "High",
  "InitiatingProcessMD5": "13cc6a05bbf6439da45411defeaffa47",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:39.5027656Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 2036,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "37d0ab300eb137e6eb344571611f000932bc6497",
  "InitiatingProcessSHA256": "e147a6284cc158ffcee9f473ace8645c03edea779df49cfcf3c7353783f53f70",
  "InitiatingProcessSessionId": 1,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184879088",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Standalone Updater",
  "InitiatingProcessVersionInfoInternalFileName": "OneDriveStandaloneUpdater.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "OneDriveStandaloneUpdater.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft OneDrive",
  "InitiatingProcessVersionInfoProductVersion": "26.123.0628.0001",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "MD5": "5337bc2acac97c53dcb5c86ddc56eeba",
  "ReportId": 14353,
  "ReportId@odata.type": "#Int64",
  "SHA1": "5e0439d5b27a45b43412bad6447ba02f475acca0",
  "SHA256": "c0c58f88dc59107aa9053cef00ec8e7c15c2be96cf11c564903853f6ea83be93",
  "Timestamp": "2026-08-01T09:03:49.1457309Z"
}

Detection Patterns #

Defender-DeviceImageLoadEvents any: Image loadORImageLoaded: Image loaded

2 rules

Kusto

PowerShell without powershell.exe (source)

FalconForce

Suspicious use of CPL file (source)

FalconForce

Stealth: DLL

Defender-DeviceFileCertificateInfo any: File signing certificate informationORDefender-DeviceImageLoadEvents any: Image loadORDefender-DeviceInfo any: Device information

1 rule

Kusto

DLL Hijacking: Loading from an Unusual Directory (source)

Cyb3rMonk

Stealth: Regsvr32

Defender-DeviceImageLoadEvents any: Image loadORDefender-DeviceNetworkEvents any: Network activity

1 rule

Kusto

Regsvr32 Rundll32 Image Loads Abnormal Extension (source)

Persistence: Windows Service

Defender-DeviceFileEvents any: File activityORDefender-DeviceImageLoadEvents any: Image loadORDefender-DeviceNetworkEvents any: Network activityORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Rare Process as a Service (source)

Persistence: Compromise Host Software Binary

Defender-DeviceEvents any: Defender eventORDefender-DeviceImageLoadEvents any: Image load

1 rule

Kusto

SUNSPOT malware hashes (source)

Show All Detection Patterns

Stealth: DLL

Defender-DeviceFileEvents FileCreated: File createdORFileModified: File modifiedORDefender-DeviceImageLoadEvents any: Image load

1 rule

Kusto

Hijack Execution Flow - DLL Side-Loading (source)

Lateral Movement: Windows Remote Management

Defender-DeviceFileEvents FileCreated: File createdORFileModified: File modifiedORFileRenamed: File renamedORDefender-DeviceImageLoadEvents any: Image loadORImageLoaded: Image loaded

1 rule

Kusto

WinRM Plugin Lateral Movement (source)

FalconForce

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Hashes[0]` (kusto rule field)	eq	`sha256`	3 rules	kusto
`ClientIP` (kusto rule field)	eq	`IPList`	2 rules	kusto
`DestinationIP` (kusto rule field)	eq	`IPList`	2 rules	kusto
`GlobalPrevalence` (kusto rule field)	lt	`100`	2 rules	kusto
`GlobalPrevalence` (kusto rule field)	lt	`200`	2 rules	kusto
`Hashes[1]` (kusto rule field)	contains	`sha256hashes`	2 rules	kusto
`IPAddresses` (kusto rule field)	eq	`IPList`	2 rules	kusto
`InitiatingProcessSHA256` (kusto rule field)	eq	`sha256hashes`	2 rules	kusto
`Message` (kusto rule field)	contains	`iplist`	2 rules	kusto
`SourceIP` (kusto rule field)	eq	`IPList`	2 rules	kusto
`dest_ip` (kusto rule field)	eq	`IPList`	2 rules	kusto
`sha256` (kusto rule field)	contains	`sha256hashes`	2 rules	kusto
`src_ip` (kusto rule field)	eq	`IPList`	2 rules	kusto
`ActionType` (kusto rule field)	eq	`InboundConnectionAccepted`	1 rule	kusto
`ActionType` (kusto rule field)	in	`FileCreated`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Europium - Hash and IP IOCs - September 2022 source high: Identifies a match across various data feeds for hashes and IP IOC related to Europium Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-governmentT1003, T1071
Mercury - Domain, Hash and IP IOCs - August 2022 source high: Identifies a match across various data feeds for domains, hashes and IP IOC related to Mercury Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/T1071
Prestige ransomware IOCs Oct 2022 source high: This query looks for file hashes and AV signatures associated with Prestige ransomware payload.T1203

Show 3 more (6 total) on the rules page

ImageLoaded: Image loaded

Table: DeviceImageLoadEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`FileName`
`FolderPath`
`SHA256`
`InitiatingProcessFileName`

Example Event #

{
  "ActionType": "ImageLoaded",
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FileName": "rpcMessages.dll",
  "FileSize": 163328,
  "FileSize@odata.type": "#Int64",
  "FolderPath": "C:\\Windows\\System32\\rpcMessages.dll",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "\"OneDriveStandaloneUpdater.exe\" /reporting",
  "InitiatingProcessCreationTime": "2026-08-01T09:03:46.8776437Z",
  "InitiatingProcessFileName": "onedrivestandaloneupdater.exe",
  "InitiatingProcessFileSize": 4407184,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\program files\\microsoft onedrive\\onedrivestandaloneupdater.exe",
  "InitiatingProcessId": 4116,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "High",
  "InitiatingProcessMD5": "13cc6a05bbf6439da45411defeaffa47",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:39.5027656Z",
  "InitiatingProcessParentFileName": "svchost.exe",
  "InitiatingProcessParentId": 2036,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "37d0ab300eb137e6eb344571611f000932bc6497",
  "InitiatingProcessSHA256": "e147a6284cc158ffcee9f473ace8645c03edea779df49cfcf3c7353783f53f70",
  "InitiatingProcessSessionId": 1,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184879088",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Standalone Updater",
  "InitiatingProcessVersionInfoInternalFileName": "OneDriveStandaloneUpdater.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "OneDriveStandaloneUpdater.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft OneDrive",
  "InitiatingProcessVersionInfoProductVersion": "26.123.0628.0001",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "MD5": "5337bc2acac97c53dcb5c86ddc56eeba",
  "ReportId": 14353,
  "ReportId@odata.type": "#Int64",
  "SHA1": "5e0439d5b27a45b43412bad6447ba02f475acca0",
  "SHA256": "c0c58f88dc59107aa9053cef00ec8e7c15c2be96cf11c564903853f6ea83be93",
  "Timestamp": "2026-08-01T09:03:49.1457309Z"
}

Detection Patterns #

Defender-DeviceImageLoadEvents any: Image loadORImageLoaded: Image loaded

2 rules

Kusto

PowerShell without powershell.exe (source)

FalconForce

Suspicious use of CPL file (source)

FalconForce

Lateral Movement: Windows Remote Management

Defender-DeviceFileEvents FileCreated: File createdORFileModified: File modifiedORFileRenamed: File renamedORDefender-DeviceImageLoadEvents any: Image loadORImageLoaded: Image loaded

1 rule

Kusto

WinRM Plugin Lateral Movement (source)

FalconForce

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`GlobalPrevalence` (kusto rule field)	lt	`100`	2 rules	kusto
`GlobalPrevalence` (kusto rule field)	lt	`200`	1 rule	kusto
`GlobalPrevalence` (kusto rule field)	lt	`500`	1 rule	kusto
`InitiatingProcessSHA1` (kusto rule field)	is_not_null		1 rule	kusto
`Signer` (kusto rule field)	is_null		1 rule	kusto

Defender-DeviceImageLoadEvents

any: Image load

Fields #

Example Event #

Detection Patterns #

Kusto

Stealth: DLL

Kusto

Stealth: Regsvr32

Kusto

Persistence: Windows Service

Kusto

Persistence: Compromise Host Software Binary

Kusto

Stealth: DLL

Kusto

Lateral Movement: Windows Remote Management

Kusto

Common Indicators #

Detection Rules #

Kusto #

ImageLoaded: Image loaded

Fields #

Example Event #

Detection Patterns #

Kusto

Lateral Movement: Windows Remote Management

Kusto

Common Indicators #

References #