DLL loaded from a temp, roaming or UNC path without a valid signature

Siemphony@siemphonymediumT1129unverified

MITRE's Windows analytic for Shared Modules describes a process loading a DLL from a user-writable, temp or UNC location, or from an unsigned/invalid signer, shortly before or after that DLL is written to disk and the loading process beacons out. Only the module load itself is a single event, so this rule matches Sysmon Module Load where `ImageLoaded` sits under one of the paths named by MITRE's SuspiciousPathRegex knob (%TEMP%, %APPDATA%, \\server\share) and the signature is anything other than Valid — the UnsignedOnly knob turned into logic. The file-write and network legs of the chain need a join across three log sources and a timer, which Sigma cannot express, so they are deliberately absent rather than faked with invented fields. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0018, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceImageLoadEvents| where ((FolderPath contains "\\AppData\\Local\\Temp\\" or FolderPath contains "\\AppData\\Roaming\\" or FolderPath contains "\\Windows\\Temp\\" or FolderPath contains "\\Users\\Public\\" or FolderPath contains "\\ProgramData\\" or FolderPath contains "\\\\") and not (SignatureStatus =~ "Valid"))

Splunk · SPL

Run this as a search.

index=* ((ImageLoaded="*\\AppData\\Local\\Temp\\*" OR ImageLoaded="*\\AppData\\Roaming\\*" OR ImageLoaded="*\\Windows\\Temp\\*" OR ImageLoaded="*\\Users\\Public\\*" OR ImageLoaded="*\\ProgramData\\*" OR ImageLoaded="*\\\\*") AND NOT (SignatureStatus="Valid"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\temp\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\roaming\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\windows\\\\temp\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\users\\\\public\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\programdata\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\\\\\*") AND NOT (TO_LOWER(file.code_signature.status) == "valid"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,image_load,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ImageLoaded" type="pcre2">(?i)(\\AppData\\Local\\Temp\\|\\AppData\\Roaming\\|\\Windows\\Temp\\|\\Users\\Public\\|\\ProgramData\\|\\\\)</field>    <field name="SignatureStatus" negate="yes" type="pcre2">(?i)^Valid$</field>    <description>DLL loaded from a temp, roaming or UNC path without a valid signature</description>    <mitre>      <id>T1129</id>    </mitre>  </rule></group>

At a glance

Logsource: image_load / windows
Level: medium
Category: script_interpreter_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 3f695c6a-38b9-4653-b059-74daf2242d98

ATT&CKT1129

T1129Shared Modules

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonscript interpreter execution

script interpreter executionAI draft — unreviewed

01 · What this rule detects

AN0052 describes a process loading a DLL from a user-writable, temp or UNC path, or from an unsigned or invalid signer, and — within a short window — that DLL having just been written to disk, or follow-on rundll32/regsvr32 execution, or outbound C2. Only the module load is a single event. The file write, the follow-on process and the network leg are a three-source join under a timer, which Sigma cannot express. So this rule — DLL loaded from a temp, roaming or UNC path without a valid signature — is the load, and only the load. Two properties of one event: suspicious location, and a signature that is not Valid.

02 · Telemetry you need

Sysmon EventID 7, Module Load, as category: image_load /
Three of four backends render. Sentinel refuses: no table is modelled for
Two of AN0052's knobs have no field on EventID 7. MinFileSizeKB needs a

03 · How the logic works

selection_path is MITRE's SuspiciousPathRegex knob — MITRE names the knob and offers %TEMP%, %APPDATA% and \\*\share\ as examples — populated here with \AppData\Local\Temp\, \AppData\Roaming\, \Windows\Temp\, \Users\Public\, \ProgramData\ and a UNC prefix. contains, not endswith, because these are directory segments in the middle of a path, not filename suffixes; the leading and trailing backslashes anchor the segment so a directory called ProgramDataArchive does not match. The UNC term is worth stopping on. It is written '\\\\' — four characters in the YAML — because Sigma unescapes \\ to one literal backslash, so four gives the two backslashes a UNC prefix needs. Written as '\\' it would collapse to "contains a backslash", which every Windows path satisfies, and selection_path would be unconditionally true while looking tighter than it is. The inline comment above that line exists so the next author does not "simplify" it. (Elsewhere in this corpus the same construct was written with two and quietly degraded.) filter_valid_signature is MITRE's UnsignedOnly knob turned into logic: alert only when SignatureStatus != Valid. Negating a single-field equality is correct Sigma and Wazuh renders it as negate="yes".

04 · Common false positives

The negation fails open. When SignatureStatus is absent from the event — a pipeline that drops it, or a Sysmon config that does not verify signatures — not filter_valid_signature evaluates true and the rule silently collapses to "any DLL load from these paths". Splunk's NOT SignatureStatus="Valid" on a null field is true, and the Elastic and Wazuh renderings behave the same way. The rule's meaning depends on whether one field survives ingest, and it changes without any error. This is the single most useful thing in the review: a negation over a field you may not be collecting is not a filter, it is a liability.
The path list is simultaneously too narrow and too broad. \ProgramData\ is matched as a whole tree, and C:\ProgramData\Microsoft\Windows Defender\ Platform\<version>\ loads on every Windows host continuously, with SignatureStatus frequently reported as Unavailable during platform updates. That is the in-box false positive on every endpoint. Meanwhile the largest user-writable surface on the machine is absent: \AppData\Local\ outside Temp, where every Electron app and every user-scope install lives, plus the profile root, \Downloads\, C:\PerfLogs, C:\Windows\Tasks and System32\spool\drivers\color. An operator who drops the DLL one directory up from Temp needs no privileges and matches none of the six terms.
Beyond that: installers staging payload DLLs in %TEMP% before the signing catalogue is registered; in-house applications deployed to %APPDATA% or run from a share, loading their own unsigned helpers on every start; build machines loading freshly compiled unsigned DLLs all day.
A translator defect, not an authoring one, but it affects this rule. The ES|QL backend emits LIKE "*\\\\*" for the UNC term; that string literal resolves to two backslashes, which ES|QL's LIKE then reads as one escaped backslash — matching every Windows path and making selection_path unconditionally true in that backend only. The same YAML is correct in Sigma, correct in Splunk and Wazuh, and wrong in Elastic. Backend rendering is part of a rule's correctness, and translations.json is where you check it.

05 · Detection maturity

tier_1: . Authored from a MITRE scaffold that contains prose, log sources and tuning knobs but no query logic, and never run against a log line. Two of the findings above — the fail-open negation and the ES|QL backslash — are failure modes that would only announce themselves once data flowed, which is exactly why the tier is where it is.
tier_2: confirm Sysmon is verifying signatures and that `SignatureStatus` survives your pipeline, then run the selection read-only and rank hits by `ImageLoaded` directory. Expect Defender's platform path at the top.
tier_3: ** rebuild the path list from what the estate actually loads, and join the load to AN0052's file_event write and network_connection legs inside MITRE's TimeWindow knob, so the alert means "a DLL that appeared minutes ago was loaded and the host then beaconed" rather than "an unsigned DLL loaded".

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Make the signature test fail closed: enumerate the statuses positively
Add \AppData\Local\ (it subsumes the Temp entry), \Downloads\,
Narrow \ProgramData\ rather than keeping the whole tree — exclude the
Expect ambiguity in the verdict, not just the volume. "Unsigned DLL from a

Declared by the author

Software installers and updaters that stage their payload DLLs in %TEMP% or %ProgramData% and load them before the signing catalogue is registered, so Sysmon reports SignatureStatus as Unavailable rather than Valid. MITRE's RareSignerThreshold knob is the intended place to record which publishers a given estate expects to see loading from those paths.
Line-of-business and in-house applications deployed to %APPDATA% or run from a file share, which load their own unsigned helper DLLs on every start. These generate a steady, per-host-identical stream rather than a one-off load.
Development and build machines, where compilers, test runners and package managers load freshly produced unsigned DLLs out of temp directories continuously.
Anti-malware, EDR and telemetry agents whose signature status is reported as Unavailable because the catalogue file is not readable at load time; the loading Image is a fixed agent binary and can be excluded by path.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1129, evaluated against their image_load events.

Share this rule

/u/siemphony/3f695c6a-38b9-4653-b059-74daf2242d98

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

DLL loaded from a temp, roaming or UNC path without a valid signature

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it