Unsigned DLL from scratch dir
An UNSIGNED module (DLL) was loaded from a scratch / user-writable directory (Sysmon ImageLoad, Event ID 7, with Signed=false or a non-Valid…
What it detects
An UNSIGNED module (DLL) was loaded from a scratch / user-writable directory (Sysmon ImageLoad, Event ID 7, with Signed=false or a non-Valid SignatureStatus, and ImageLoaded under Temp / AppData / ProgramData / Public / Downloads). DLL side-loading drops a malicious DLL next to — or on the search path of — a trusted executable so it loads under that program's identity and signature reputation. Legitimate DLLs are signed and load from System32 / Program Files / WinSxS; an unsigned DLL loading from a scratch path is the side-loading shape. The parser decides "unsigned" (Sysmon's Signed / SignatureStatus), so this keys on a distinct action rather than a brittle message string.
MITRE ATT&CK mapping
- T1574.002Hijack Execution Flow· Persistence · retired in ATT&CK v17
False positives and triage
Some legitimate software ships unsigned helper DLLs in AppData/ProgramData (in-house tools, older installers, a few Electron stacks). The strong signal is an unsigned DLL in a scratch path loaded by a TRUSTED / system binary (classic side-loading), or one whose name shadows a known system DLL. Confirm the loading process, the DLL's origin, and whether the pair was an approved install; allow-list a known unsigned in-house DLL by path if needed.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/windows/unsigned_dll_from_scratch_dir.yaml, licensed under the Apache License 2.0.
id: windows.execution.unsigned_dll_from_scratch_dir
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [windows]
mitre_techniques: [T1574.002]
description: |
An UNSIGNED module (DLL) was loaded from a scratch / user-writable directory (Sysmon
ImageLoad, Event ID 7, with Signed=false or a non-Valid SignatureStatus, and ImageLoaded
under Temp / AppData / ProgramData / Public / Downloads). DLL side-loading drops a
malicious DLL next to — or on the search path of — a trusted executable so it loads under
that program's identity and signature reputation. Legitimate DLLs are signed and load from
System32 / Program Files / WinSxS; an unsigned DLL loading from a scratch path is the
side-loading shape. The parser decides "unsigned" (Sysmon's Signed / SignatureStatus), so
this keys on a distinct action rather than a brittle message string.
match:
event_action: unsigned_image_loaded
file_path_contains_any:
- "\\Temp\\"
- "\\AppData\\"
- "\\ProgramData\\"
- "\\Users\\Public\\"
- "\\Downloads\\"
false_positive_guidance: |
Some legitimate software ships unsigned helper DLLs in AppData/ProgramData (in-house tools,
older installers, a few Electron stacks). The strong signal is an unsigned DLL in a scratch
path loaded by a TRUSTED / system binary (classic side-loading), or one whose name shadows a
known system DLL. Confirm the loading process, the DLL's origin, and whether the pair was an
approved install; allow-list a known unsigned in-house DLL by path if needed.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.