↳ GitHub sourceAnalytics ruleMedium

Hijack Execution Flow - DLL Side-Loading

Description

This detection tries to identify all DLLs loaded by "high integrity" processes and cross-checks the DLL paths against FileCreate/FileModify events of the same DLL by a medium integrity process. Of course, we need to do some magic to filter out false positives as much as possible. So any FileCreate/FileModify done by "NT Authoriy\System" and the "RID 500" users aren't interesting. Also, we only want to see the FileCreate/FileModify actions which are performed with a default or limited token elevation. If done with a full elevated token, the user is apparently admin already.

Rule type: Scheduled
Version: 1.0.1
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

MicrosoftThreatProtection

Data types

DeviceFileEvents DeviceImageLoadEvents

KQL query

Original query, unchanged.

let imls = materialize(
    DeviceImageLoadEvents
    | where InitiatingProcessIntegrityLevel in ("High", "System") and FileName !endswith ".exe"
    | project FolderPath=tolower(FolderPath), InitiatingProcessFileName, InitiatingProcessIntegrityLevel, DeviceId, DeviceName
    | distinct FolderPath, InitiatingProcessFileName, InitiatingProcessIntegrityLevel, DeviceId, DeviceName
);
imls
| join (
    DeviceFileEvents
    | where FolderPath in~ ((imls | project FolderPath)) and ActionType in ("FileCreated", "FileModified") and
    InitiatingProcessIntegrityLevel !in ("High", "System", "") and InitiatingProcessAccountSid != "S-1-5-18" and
    InitiatingProcessTokenElevation in ("TokenElevationTypeDefault", "TokenElevationTypeLimited") and InitiatingProcessAccountSid !endswith "-500"
    | extend FolderPath=tolower(FolderPath)
) on FolderPath, DeviceId, DeviceName
| project-away FolderPath1

Declared entities

HostAccountProcess

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/FalconFriday/Analytic Rules/DLLSideLoading.yaml ↗
Commit: 9800e51 ↗
Source identifier: 3084b487-fad6-4000-9544-6085b9657290

Additional source files 2

Solutions/FalconFriday/Analytic Rules/DLLSideLoading.yamlsource ↗Solutions/FalconFriday/Data/Solution_FalconFriday.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.