win:sysmon 7
Image loaded
The image loaded event logs when a module is loaded in a specific process.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Minimum
- Techniques
- 99
- Rules depending on it
- Splunk 39, Sigma 125, Elastic 14, Microsoft Sentinel 1
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | |
| Windows member server | Minimum | |
| Windows domain controller | Minimum | |
| Windows web server (IIS), internet-facing | Minimum |
Techniques it helps detect
- T1003.004 LSA Secrets
- T1021.003 Distributed Component Object Model
- T1027.007 Dynamic API Resolution
- T1027.013 Encrypted/Encoded File
- T1027.014 Polymorphic Code
- T1027.018 Invisible Unicode
- T1055 Process Injection
- T1055.001 Dynamic-link Library Injection
- T1055.005 Thread Local Storage
- T1056.004 Credential API Hooking
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1106 Native API
- T1113 Screen Capture
- T1124 System Time Discovery
- T1125 Video Capture
- T1127 Trusted Developer Utilities Proxy Execution
- T1127.001 MSBuild
- T1127.002 ClickOnce
- T1129 Shared Modules
- T1137.002 Office Test
- T1137.003 Outlook Forms
- T1137.004 Outlook Home Page
- T1137.005 Outlook Rules
- T1185 Browser Session Hijacking
- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1195.003 Compromise Hardware Supply Chain
- T1200 Hardware Additions
- T1205.002 Socket Filters
- T1210 Exploitation of Remote Services
- T1211 Exploitation for Stealth
- T1216 System Script Proxy Execution
- T1216.001 PubPrn
- T1216.002 SyncAppvPublishingServer
- T1218 System Binary Proxy Execution
- T1218.001 Compiled HTML File
- T1218.002 Control Panel
- T1218.004 InstallUtil
- T1218.007 Msiexec
- T1218.008 Odbcconf
- T1218.009 Regsvcs/Regasm
- T1218.010 Regsvr32
- T1218.011 Rundll32
- T1218.012 Verclsid
- T1218.013 Mavinject
- T1218.014 MMC
- T1218.015 Electron Applications
- T1220 XSL Script Processing
- T1480 Execution Guardrails
- T1480.001 Environmental Keying
- T1482 Domain Trust Discovery
- T1497 Virtualization/Sandbox Evasion
- T1497.001 System Checks
- T1497.003 Time Based Checks
- T1505.002 Transport Agent
- T1505.004 IIS Components
- T1505.005 Terminal Services DLL
- T1518.001 Security Software Discovery
- T1546.003 Windows Management Instrumentation Event Subscription
- T1546.007 Netsh Helper DLL
- T1546.009 AppCert DLLs
- T1546.010 AppInit DLLs
- T1546.011 Application Shimming
- T1546.015 Component Object Model Hijacking
- T1547.002 Authentication Package
- T1547.003 Time Providers
- T1547.004 Winlogon Helper DLL
- T1547.005 Security Support Provider
- T1547.010 Port Monitors
- T1547.012 Print Processors
- T1548.002 Bypass User Account Control
- T1550.003 Pass the Ticket
- T1553.002 Code Signing
- T1553.003 SIP and Trust Provider Hijacking
- T1556 Modify Authentication Process
- T1556.001 Domain Controller Authentication
- T1556.002 Password Filter DLL
- T1556.007 Hybrid Identity
- T1556.008 Network Provider DLL
- T1559.001 Component Object Model
- T1559.002 Dynamic Data Exchange
- T1560 Archive Collected Data
- T1560.001 Archive via Utility
- T1560.002 Archive via Library
- T1573 Encrypted Channel
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography
- T1574 Hijack Execution Flow
- T1574.001 DLL
- T1574.005 Executable Installer File Permissions Weakness
- T1574.012 COR_PROFILER
- T1574.014 AppDomainManager
- T1620 Reflective Code Loading
- T1678 Delay Execution
Rules that depend on it
Splunk 39
- CMLUA Or CMSTPLUA UAC Bypass
- Loading Of Dynwrapx Module
- MS Scripting Process Loading Ldap Module
- MS Scripting Process Loading WMI Module
- MSI Module Loaded by Non-System Binary
- Spoolsv Suspicious Loaded Modules
- Sunburst Correlation DLL and Network Event
- UAC Bypass MMC Load Unsigned Dll
- UAC Bypass With Colorui COM Object
- Wbemprox COM Object Execution
- Windows BitDefender Submission Wizard DLL Sideloading
- Windows Cloud Files Filter Loaded by Uncommon Process
- Windows Credentials Access via VaultCli Module
- Windows DLL Module Loaded in Temp Dir
- Windows DLL Search Order Hijacking Hunt with Sysmon
- Windows DLL Side-Loading In Calc
- Windows Defender MpClient.dll Loaded by Non-Defender Process
- Windows Devtunnels Image Loaded
- Windows Executable in Loaded Modules
- Windows Gather Victim Identity SAM Info
- Windows Hijack Execution Flow Version Dll Side Load
- Windows Input Capture Using Credential UI Dll
- Windows InstallUtil Credential Theft
- Windows Known Abused DLL Loaded Suspiciously
- Windows Known GraphicalProton Loaded Modules
- Windows MMC Loaded Script Engine DLL
- Windows NetSupport RMM DLL Loaded By Uncommon Process
- Windows Office Product Loaded MSHTML Module
- Windows Office Product Loading Taskschd DLL
- Windows Office Product Loading VBE7 DLL
- Windows Remote Access Software BRC4 Loaded Dll
- Windows Remote Image Load
- Windows Scheduled Task DLL Module Loaded
- Windows SpeechRuntime COM Hijacking DLL Load
- Windows SqlWriter SQLDumper DLL Sideload
- Windows Unsigned DLL Side-Loading
- Windows Unsigned DLL Side-Loading In Same Process Path
- Windows Unsigned MS DLL Side-Loading
- Windows Unusual Process Load Mozilla NSS-Mozglue Module
Sigma 125
- APT PRIVATELOG Image Load Pattern by Florian Roth (Nextron Systems)
- Abusable DLL Potential Sideloading From Suspicious Location by X__Junior (Nextron Systems)
- Amsi.DLL Load By Uncommon Process by frack113
- Amsi.DLL Loaded Via LOLBIN Process by Nasreddine Bencherchali (Nextron Systems)
- Aruba Network Service Potential DLL Sideloading by Nasreddine Bencherchali (Nextron Systems)
- BITS Client BitsProxy DLL Loaded By Uncommon Process by UnicornOfHunt
- BaaUpdate.exe Suspicious DLL Load by Swachchhanda Shrawan Poudel (Nextron Systems)
- CLR DLL Loaded Via Office Applications by Antonlovesdnb
- Clfs.SYS Loaded By Process Located In a Potential Suspicious Location by X__Junior
- CredUI.DLL Loaded By Uncommon Process by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- DLL Load By System Process From Suspicious Locations by Nasreddine Bencherchali (Nextron Systems)
- DLL Loaded From Suspicious Location Via Cmspt.EXE by Nasreddine Bencherchali (Nextron Systems)
- DLL Names Used By SVR For GraphicalProton Backdoor by CISA
- DLL Sideloading Of ShellChromeAPI.DLL by Nasreddine Bencherchali (Nextron Systems)
- Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process by Perez Diego (@darkquassar), oscd.community, Ecco
- Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE by Greg (rule)
- Diamond Sleet APT DLL Sideloading Indicators by Nasreddine Bencherchali (Nextron Systems)
- DotNET Assembly DLL Loaded Via Office Application by Antonlovesdnb
- DotNet CLR DLL Loaded By Scripting Applications by omkar72, oscd.community
- Fax Service DLL Search Order Hijack by NVISO
- FoggyWeb Backdoor DLL Loading by Florian Roth (Nextron Systems)
- GAC DLL Loaded Via Office Applications by Antonlovesdnb
- HackTool - SILENTTRINITY Stager DLL Load by Aleksey Potapov, oscd.community
- HackTool - SharpEvtMute DLL Load by Florian Roth (Nextron Systems)
- Kapeka Backdoor Loaded Via Rundll32.EXE by Swachchhanda Shrawan Poudel
- Katz Stealer DLL Loaded by Swachchhanda Shrawan Poudel (Nextron Systems)
- Lazarus APT DLL Sideloading Activity by Thurein Oo, Nasreddine Bencherchali (Nextron Systems)
- Load Of RstrtMgr.DLL By A Suspicious Process by Luc Génaux
- Load Of RstrtMgr.DLL By An Uncommon Process by Luc Génaux
- MMC Loading Script Engines DLLs by Swachchhanda Shrawan Poudel (Nextron Systems)
- Malicious DLL Load By Compromised 3CXDesktopApp by Nasreddine Bencherchali (Nextron Systems)
- Microsoft Excel Add-In Loaded by Nasreddine Bencherchali (Nextron Systems)
- Microsoft Excel Add-In Loaded From Uncommon Location by Nasreddine Bencherchali (Nextron Systems)
- Microsoft Office DLL Sideload by Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
- Microsoft VBA For Outlook Addin Loaded Via Outlook by Nasreddine Bencherchali (Nextron Systems)
- Microsoft Word Add-In Loaded by Steffen Rogge (dr0pd34d)
- PCRE.NET Package Image Load by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Pingback Backdoor DLL Loading Activity by Bhabesh Raj
- Potential 7za.DLL Sideloading by X__Junior
- Potential AVKkid.DLL Sideloading by X__Junior (Nextron Systems)
- Potential Antivirus Software DLL Sideloading by Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
- Potential Azure Browser SSO Abuse by Den Iuzvyk
- Potential CCleanerDU.DLL Sideloading by X__Junior (Nextron Systems)
- Potential CCleanerReactivator.DLL Sideloading by X__Junior
- Potential COLDSTEEL Persistence Service DLL Load by Nasreddine Bencherchali (Nextron Systems)
- Potential CSharp Streamer RAT Loading .NET Executable Image by Luca Di Bartolomeo
- Potential CVE-2024-35250 Exploitation Activity by @eyezuhk Isaac Fernandes
- Potential Chrome Frame Helper DLL Sideloading by Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
- Potential DCOM InternetExplorer.Application DLL Hijack - Image Load by Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga
- Potential DLL Sideloading Of DBGCORE.DLL by Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
- Potential DLL Sideloading Of DBGHELP.DLL by Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
- Potential DLL Sideloading Of DbgModel.DLL by Gary Lobermier
- Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE by Swachchhanda Shrawan Poudel
- Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE by Nasreddine Bencherchali (Nextron Systems)
- Potential DLL Sideloading Of MpSvc.DLL by Nasreddine Bencherchali (Nextron Systems), Wietze Beukema
- Potential DLL Sideloading Of MsCorSvc.DLL by Wietze Beukema
- Potential DLL Sideloading Of Non-Existent DLLs From System Folders by Nasreddine Bencherchali (Nextron Systems), SBousseaden
- Potential DLL Sideloading Using Coregen.exe by frack113
- Potential DLL Sideloading Via ClassicExplorer32.dll by frack113
- Potential DLL Sideloading Via JsSchHlp by frack113
- Potential DLL Sideloading Via VMware Xfer by Nasreddine Bencherchali (Nextron Systems)
- Potential DLL Sideloading Via comctl32.dll by Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash)
- Potential EACore.DLL Sideloading by X__Junior (Nextron Systems)
- Potential Edputil.DLL Sideloading by X__Junior (Nextron Systems)
- Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load by Swachchhanda Shrawan Poudel (Nextron Systems)
- Potential Goopdate.DLL Sideloading by X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
- Potential Iviewers.DLL Sideloading by X__Junior (Nextron Systems)
- Potential JLI.dll Side-Loading by Swachchhanda Shrawan Poudel (Nextron Systems)
- Potential Libvlc.DLL Sideloading by X__Junior
- Potential Mfdetours.DLL Sideloading by Nasreddine Bencherchali (Nextron Systems)
- Potential Mpclient.DLL Sideloading by Bhabesh Raj
- Potential Python DLL SideLoading by Swachchhanda Shrawan Poudel
- Potential Raspberry Robin Aclui Dll SideLoading by Swachchhanda Shrawan Poudel
- Potential Rcdll.DLL Sideloading by X__Junior (Nextron Systems)
- Potential RjvPlatform.DLL Sideloading From Default Location by X__Junior (Nextron Systems)
- Potential RjvPlatform.DLL Sideloading From Non-Default Location by X__Junior (Nextron Systems)
- Potential RoboForm.DLL Sideloading by X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
- Potential ShellDispatch.DLL Sideloading by X__Junior (Nextron Systems)
- Potential SmadHook.DLL Sideloading by X__Junior (Nextron Systems)
- Potential SolidPDFCreator.DLL Sideloading by X__Junior (Nextron Systems)
- Potential System DLL Sideloading From Non System Locations by Nasreddine Bencherchali (Nextron Systems)
- Potential Vcruntime140 DLL Sideloading by Swachchhanda Shrawan Poudel (Nextron Systems)
- Potential Vivaldi_elf.DLL Sideloading by X__Junior (Nextron Systems)
- Potential WWlib.DLL Sideloading by X__Junior (Nextron Systems)
- Potential Waveedit.DLL Sideloading by X__Junior (Nextron Systems)
- Potential Wazuh Security Platform DLL Sideloading by X__Junior (Nextron Systems)
- Potential appverifUI.DLL Sideloading by X__Junior (Nextron Systems)
- Potentially Suspicious Image Load of Offreg.dll by Swachchhanda Shrawan Poudel (Nextron Systems)
- Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load by frack113
- PowerShell Core DLL Loaded By Non PowerShell Process by Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- PowerShell Core DLL Loaded Via Office Application by Nasreddine Bencherchali (Nextron Systems)
- Python Image Load By Non-Python Process by Patrick St. John, OTR (Open Threat Research)
- Remote DLL Load Via Rundll32.EXE by Nasreddine Bencherchali (Nextron Systems)
- Signed DLL Loaded With Missing PE Version Metadata by Swachchhanda Shrawan Poudel (Nextron Systems)
- Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location by Swachchhanda Shrawan Poudel (Nextron Systems)
- Suspicious Renamed Comsvcs DLL Loaded By Rundll32 by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded by Perez Diego (@darkquassar), oscd.community, Ecco
- Suspicious Unsigned Thor Scanner Execution by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Volume Shadow Copy VSS_PS.dll Load by Markus Neis, @markus_neis
- Suspicious Volume Shadow Copy Vssapi.dll Load by frack113
- Suspicious WSMAN Provider Image Loads by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- System Control Panel Item Loaded From Uncommon Location by Anish Bogati
- System Drawing DLL Load by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location by Swachchhanda Shrawan Poudel
- Third Party Software DLL Sideloading by Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
- Time Travel Debugging Utility Usage - Image by Ensar Şamil, @sblmsrsn, @oscd_initiative
- Trusted Path Bypass via Windows Directory Spoofing by Swachchhanda Shrawan Poudel (Nextron Systems)
- UAC Bypass Using Iscsicpl - ImageLoad by Nasreddine Bencherchali (Nextron Systems)
- UAC Bypass With Fake DLL by oscd.community, Dmitry Uchakin
- Unsigned .node File Loaded by Jonathan Beierle (@hullabrian)
- Unsigned DLL Loaded by Windows Utility by Swachchhanda Shrawan Poudel
- Unsigned Image Loaded Into LSASS Process by Teymur Kheirkhabarov, oscd.community
- Unsigned Mfdetours.DLL Sideloading by Nasreddine Bencherchali (Nextron Systems)
- Unsigned Module Loaded by ClickOnce Application by @SerkinValery
- VBA DLL Loaded Via Office Application by Antonlovesdnb
- VMGuestLib DLL Sideload by Nasreddine Bencherchali (Nextron Systems)
- VMMap Signed Dbghelp.DLL Potential Sideloading by Nasreddine Bencherchali (Nextron Systems)
- VMMap Unsigned Dbghelp.DLL Potential Sideloading by Nasreddine Bencherchali (Nextron Systems)
- WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- WMI Module Loaded By Uncommon Process by Roberto Rodriguez @Cyb3rWard0g
- WMI Persistence - Command Line Event Consumer by Thomas Patzke
- WMIC Loading Scripting Libraries by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze by Swachchhanda Shrawan Poudel (Nextron Systems)
- Windows Spooler Service Suspicious Binary Load by FPT.EagleEye, Thomas Patzke (improvements)
- Wmiprvse Wbemcomn DLL Hijack by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Elastic 14
- Outbound Scheduled Task Activity via PowerShellinferred
- Potential Credential Access via Renamed COM+ Services DLL
- Potential Credential Access via Trusted Developer Utilityinferred
- Scheduled Task Created by a Windows Scriptinferred
- Suspicious DLL Loaded for Persistence or Privilege Escalationinferred
- Suspicious Image Load (taskschd.dll) from MS Officeinferred
- Suspicious RDP ActiveX Client Loadedinferred
- Suspicious Script Object Executioninferred
- Suspicious WMI Image Load from MS Officeinferred
- Suspicious WMIC XSL Script Executioninferred
- Unsigned DLL loaded by DNS Serviceinferred
- Untrusted DLL Loaded by Azure AD Connect Authentication Agentinferred
- WPS Office Exploitation via DLL Hijackinferred
- Windows Script Interpreter Executing Process via WMIinferred
Microsoft Sentinel 1
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Indicators of compromiseAppendix B item 5(7) | Supports an activity | our analysis: loaded image hashes |
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | ClassifiedModuleLoad | Partial | pySigma-backend-crowdstrike: image_load -> ClassifiedModuleLoad; the sensor classifies and reports a subset of module loads, not every load |
| Microsoft Defender for Endpoint device tables | DeviceImageLoadEvents | Full | pySigma-backend-kusto: image_load -> DeviceImageLoadEvents |
| Elastic Defend endpoint events | library | Full | Elastic Defend library dataset |