Skip to content

Hide Navigation Hide TOC

Unsigned DLL Loaded by Windows Utility (b5de0c9a-6f19-43e0-af4e-55ad01f550af)

Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy execution of malicious code.

Cluster A Galaxy A Cluster B Galaxy B Level
Regsvr32 - T1218.010 (b97f1d35-4249-4486-a6b5-ee60ccf24fab) Attack Pattern Unsigned DLL Loaded by Windows Utility (b5de0c9a-6f19-43e0-af4e-55ad01f550af) Sigma-Rules 1
Unsigned DLL Loaded by Windows Utility (b5de0c9a-6f19-43e0-af4e-55ad01f550af) Sigma-Rules Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5) Attack Pattern 1
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern Regsvr32 - T1218.010 (b97f1d35-4249-4486-a6b5-ee60ccf24fab) Attack Pattern 2
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5) Attack Pattern 2