SignalHunt
← All rules

SYS-4003

medium

Unsigned Image Loaded from a User-Writable Temp Directory

Detects an unsigned DLL/EXE image being loaded from a user-writable temp directory - a common pattern for DLL side-loading and in-memory payload staging, since legitimate signed software rarely loads code from a location a standard user can write to.

T1574.002

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "EventID": 7,
    "Signed": false,
    "ImageLoaded|contains": "\\AppData\\Local\\Temp\\"
  }
}

Log source: product=windows, service=sysmon · Event ID(s): 7

Required log fields

  • ImageLoaded
  • Signed
  • Signature
  • Image

Enabling this in your environment

Where: Sysmon configuration - ImageLoad (Event ID 7) enabled. This event type is high-volume; most baseline configs filter it to unsigned images only at the config level, which this rule then narrows further by path.

sysmon64.exe -c sysmonconfig.xml

Event ID 7 is one of the noisiest Sysmon event types - confirm your config's ImageLoad filter (e.g. "Signed is false") before enabling this rule, or you'll be evaluating it against a firehose.

False positives

  • Some legitimate installers/updaters unpack and load unsigned helper DLLs from temp during setup

References