Sunturai
Back to results
InformationalSplunk security contentRaven Tait +1

Windows Remote Image Load

The following analytic detects image load events where a process loads a file from a remote share path. This activity is significant because remote DLL or image loading can be abused for execution, defense evasion,…

Description

The following analytic detects image load events where a process loads a file from a remote share path. This activity is significant because remote DLL or image loading can be abused for execution, defense evasion, or lateral movement while leaving the payload hosted on another system. If confirmed malicious, an attacker may be loading code into a local process from attacker-controlled infrastructure.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 4 ATT&CK techniques it maps to.

Log source category
sysmon_eventid_7

Known benign triggers

  • Legitimate software updates or remote imaging tools may load images from shared folders. Filter these detections for approved applications to reduce false positives.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice