Potential DLL Sideloading Of Non-Existent DLLs From System Folders

Status: test
Severity: high
Log source: category image_load, product windows
Author: Nasreddine Bencherchali (Nextron Systems), SBousseaden
Source: github.com/SigmaHQ/sigma

Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1574.001` Hijack Execution Flow: DLL
Stealth	`T1574.001` Hijack Execution Flow: DLL

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 7: Image loaded

Rule body

title: Potential DLL Sideloading Of Non-Existent DLLs From System Folders
id: 6b98b92b-4f00-4f62-b4fe-4d1920215771
related:
    - id: df6ecb8b-7822-4f4b-b412-08f524b4576c # FileEvent rule
      type: similar
    - id: 602a1f13-c640-4d73-b053-be9a2fa58b77
      type: obsolete
status: test
description: |
    Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts.
    Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.
references:
    - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
    - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/
    - https://decoded.avast.io/martinchlumecky/png-steganography/
    - https://github.com/Wh04m1001/SysmonEoP
    - https://itm4n.github.io/cdpsvc-dll-hijacking/
    - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
    - https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/
    - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/
    - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
    - https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/
    - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/
    - https://x.com/0gtweet/status/1564131230941122561
author: Nasreddine Bencherchali (Nextron Systems), SBousseaden
date: 2022-12-09
modified: 2026-01-24
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith:
            # Add other DLLs
            - ':\Windows\System32\axeonoffhelper.dll'
            - ':\Windows\System32\cdpsgshims.dll'
            - ':\Windows\System32\oci.dll'
            - ':\Windows\System32\offdmpsvc.dll'
            - ':\Windows\System32\shellchromeapi.dll'
            - ':\Windows\System32\TSMSISrv.dll'
            - ':\Windows\System32\TSVIPSrv.dll'
            - ':\Windows\System32\wbem\wbemcomn.dll'
            - ':\Windows\System32\WLBSCTRL.dll'
            - ':\Windows\System32\wow64log.dll'
            - ':\Windows\System32\WptsExtensions.dll'
    filter_main_ms_signed:
        Signed: 'true'
        SignatureStatus: 'Valid'
        # There could be other signatures (please add when found)
        Signature: 'Microsoft Windows'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    ImageLoaded|endswith:
        - ':\Windows\System32\axeonoffhelper.dll'
        - ':\Windows\System32\cdpsgshims.dll'
        - ':\Windows\System32\oci.dll'
        - ':\Windows\System32\offdmpsvc.dll'
        - ':\Windows\System32\shellchromeapi.dll'
        - ':\Windows\System32\TSMSISrv.dll'
        - ':\Windows\System32\TSVIPSrv.dll'
        - ':\Windows\System32\wbem\wbemcomn.dll'
        - ':\Windows\System32\WLBSCTRL.dll'
        - ':\Windows\System32\wow64log.dll'
        - ':\Windows\System32\WptsExtensions.dll'

Stage 2: `not filter_main_ms_signed`

filter_main_ms_signed:
    Signed: 'true'
    SignatureStatus: 'Valid'
    Signature: 'Microsoft Windows'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Signature`	eq	`Microsoft Windows`	`excludes:Signature` `field:"Signature" value:"Microsoft Windows"`
`SignatureStatus`	eq	`Valid`	`excludes:SignatureStatus` `field:"SignatureStatus" value:"Valid"`
`Signed`	eq	`true`	`excludes:Signed` `field:"Signed" value:"true"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ImageLoaded`	ends_with	`:\Windows\System32\TSMSISrv.dll` `:\Windows\System32\TSVIPSrv.dll` `:\Windows\System32\WLBSCTRL.dll` `:\Windows\System32\WptsExtensions.dll` `:\Windows\System32\axeonoffhelper.dll` `:\Windows\System32\cdpsgshims.dll` `:\Windows\System32\oci.dll` `:\Windows\System32\offdmpsvc.dll` `:\Windows\System32\shellchromeapi.dll` `:\Windows\System32\wbem\wbemcomn.dll` `:\Windows\System32\wow64log.dll`	`field:"ImageLoaded" kind:ends_with`