Lazarus APT DLL Sideloading Activity Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•20

Detects the sideloading of specific trojanized DLLs by legitimate Windows executables, a technique observed in Lazarus APT campaigns targeting a Spanish aerospace company. The rule identifies suspicious DLL loads by monitoring 'ImageLoaded' events for particular DLLs being loaded by specific executables from unusual paths, indicating potential DLL hijacking or sideloading for persistence, privilege escalation, or defense evasion.