Native API DLL loaded from outside the system directories

Siemphony@siemphonymediumT1106unverified

T1106 is defined by invoking the native API directly, and a syscall stub executing inside a process emits no record in any log source Sigma can address — so this rule takes the precursor AN1465 actually names and nothing beyond it: a module load of `ntdll.dll`, `kernel32.dll` or `kernelbase.dll` from a path that is not one of the directories Windows serves these modules from. Note what such an event is and is not: all three are KnownDLLs, already mapped into every process before user code runs, so a LoadLibrary against a private copy resolves by base name to the module already present and maps nothing. What produces this event is an image-section map of an on-disk copy — NtCreateSection with SEC_IMAGE plus NtMapViewOfSection, the pattern unhooking tooling uses to obtain a clean export table — which does drive the image-load notify routine. An implant that reads the file and maps the PE into RW memory itself remains invisible here. The module list is MITRE's `DllName` knob populated with the three low-level providers, and the path filter carries the entire signal, so it is anchored with startswith rather than contains: a contains filter would be satisfied by any attacker-created directory whose path merely embeds `\Windows\System32\`. It assumes Windows on C:, and it requires Sysmon EID 7 with ImageLoad enabled and these three modules not filtered out — ImageLoad is the most expensive Sysmon event class, and the widely copied configurations ship an include list that does not name them, so a quiet result usually means the events were never generated. UNVERIFIED — derived from MITRE ATT&CK DET0529 and never executed against logs.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceImageLoadEvents| where ((FolderPath endswith "\\ntdll.dll" or FolderPath endswith "\\kernel32.dll" or FolderPath endswith "\\kernelbase.dll") and not ((FolderPath startswith "C:\\Windows\\System32\\" or FolderPath startswith "C:\\Windows\\SysWOW64\\" or FolderPath startswith "C:\\Windows\\WinSxS\\" or FolderPath startswith "C:\\Windows\\SyChpe32\\" or FolderPath startswith "C:\\Windows\\SysArm32\\")))

Splunk · SPL

Run this as a search.

index=* ((ImageLoaded="*\\ntdll.dll" OR ImageLoaded="*\\kernel32.dll" OR ImageLoaded="*\\kernelbase.dll") AND NOT ((ImageLoaded="C:\\Windows\\System32\\*" OR ImageLoaded="C:\\Windows\\SysWOW64\\*" OR ImageLoaded="C:\\Windows\\WinSxS\\*" OR ImageLoaded="C:\\Windows\\SyChpe32\\*" OR ImageLoaded="C:\\Windows\\SysArm32\\*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(file.path) LIKE "*\\\\ntdll.dll" OR TO_LOWER(file.path) LIKE "*\\\\kernel32.dll" OR TO_LOWER(file.path) LIKE "*\\\\kernelbase.dll") AND NOT ((TO_LOWER(file.path) LIKE "c:\\\\windows\\\\system32\\\\*" OR TO_LOWER(file.path) LIKE "c:\\\\windows\\\\syswow64\\\\*" OR TO_LOWER(file.path) LIKE "c:\\\\windows\\\\winsxs\\\\*" OR TO_LOWER(file.path) LIKE "c:\\\\windows\\\\sychpe32\\\\*" OR TO_LOWER(file.path) LIKE "c:\\\\windows\\\\sysarm32\\\\*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,image_load,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ImageLoaded" type="pcre2">(?i)(\\ntdll\.dll$|\\kernel32\.dll$|\\kernelbase\.dll$)</field>    <field name="ImageLoaded" negate="yes" type="pcre2">(?i)(^C:\\Windows\\System32\\|^C:\\Windows\\SysWOW64\\|^C:\\Windows\\WinSxS\\|^C:\\Windows\\SyChpe32\\|^C:\\Windows\\SysArm32\\)</field>    <description>Native API DLL loaded from outside the system directories</description>    <mitre>      <id>T1106</id>    </mitre>  </rule></group>

At a glance

Logsource: image_load / windows
Level: medium
Category: native_api_evasion
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 3 Sept 2026
Rule ID: 983573b7-3b35-41e2-840e-c1f5a2595b85

ATT&CKT1106

T1106Native API

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonnative api evasion

native api evasion

01 · What this rule detects

A private copy of the operating system's own execution machinery — ntdll.dll, kernel32.dll or kernelbase.dll — mapped from anywhere outside the directories Windows serves those modules from. The reason to do it: a fresh, unhooked ntdll lets a payload issue syscalls without passing the monitoring points security products install in the loaded copy.

02 · Telemetry you need

Module load events with the full loaded-image path (Sysmon Event ID 7) — the path is the entire signal
The loading process and its ancestry, because what mapped the module matters more than that it was mapped
Signature and hash of the loaded file, resolved downstream, to separate a pristine relocated copy from a tampered one
EDR memory-region telemetry at the top tier, for the direct-syscall activity the module load merely precedes

03 · How the logic works

The three DLLs are KnownDLLs, mapped into every process before user code runs, so a LoadLibrary by base name resolves to the copy already present and produces no load event at all. What does produce this event is an explicit image-section map of an on-disk file at a chosen path — which is precisely the unhooking manoeuvre: map a clean ntdll from disk, resolve syscall numbers from it, and call them directly, leaving the instrumented copy untouched. The rule subtracts only the paths Windows itself serves these modules from — System32, SysWOW64, WinSxS and the CHPE/ARM variants — and reads everything else as a claim requiring explanation. The technique itself, a syscall stub executing inside a process, emits nothing any log source can address; this precursor is the observable, and the lesson is to know exactly which precursor an evasion technique cannot avoid.

04 · Common false positives

Endpoint security products that keep a pristine ntdll in their own directory and map it on every integrity check to diff against the hooked in-memory copy — the same mechanism, indistinguishable, and the highest-volume source on estates running such a product
Feature updates and servicing, which stage a complete OS image under $WINDOWS.~BT or the servicing tree and map the staged copies during upgrade
Build and test machines loading instrumented or debug runtimes and their system modules from build output directories
WinPE and offline-servicing sessions, where the running OS lives at X:\ or a mounted image path and every ordinary load falls outside a C:\Windows-anchored filter

05 · Detection maturity

Tier 1 — starting point: Matches the three module names loaded from any non-system path, with only the Windows-served directories excluded.
Tier 2 — tuned: Excludes the estate's security and servicing mappers by image path, and raises severity by loading-process ancestry.
Tier 3 — correlated: Correlates the relocated load with subsequent direct-syscall or injection telemetry from EDR, and treats a modified (hash-unknown) copy as an incident on its own.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude the security product's install directory first — a residual match then means considerably more, which is the correct direction for an evasion detection
Join with process ancestry: an office application, script host or anything recently spawned from a user download mapping ntdll from a temp path is close to self-proving
Rank unsigned or hash-unknown copies above pristine ones — a relocated clean copy is evasion, a modified one is worse
Baseline a week before alerting: the legitimate mappers (upgraders, integrity checkers) are periodic and enumerable, and what remains is short

Declared by the author

Endpoint security products that keep a pristine copy of ntdll.dll in their program directory and map it as an image on every integrity check to compare against the hooked in-memory copy. This is the same SEC_IMAGE mechanism the rule is looking for, so it is indistinguishable, and on an estate running such a product it is the highest-volume match by a wide margin — which is what the medium level reflects. Exclude that product's install directory and a residual hit means considerably more.
Feature updates and servicing, which stage a complete system image under C:\$WINDOWS.~BT\, C:\$WinREAgent\ or C:\Windows\servicing\ and then run setup binaries that map the staged copies of these DLLs for the duration of the upgrade.
Build and test machines, where an instrumented or debug runtime and its dependent system modules are loaded from the build output directory rather than from System32.
Imaging and offline-servicing sessions, where the running OS lives under X:\Windows\System32\ in WinPE or the target image is mounted at a path such as C:\mount\Windows\System32\, so every ordinary module load in that session falls outside a filter anchored on C:\Windows.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1106, evaluated against their image_load events.

Share this rule

/u/siemphony/983573b7-3b35-41e2-840e-c1f5a2595b85

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Native API DLL loaded from outside the system directories

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it