Sysmon Event ID 7: Image loaded
Records DLLs loaded by a process, with hashes and signature status.
- Log
- Microsoft-Windows-Sysmon/Operational
- Category
- Process
Why it matters
- Catches DLL side-loading, where a signed program is tricked into loading a malicious DLL. Very noisy; filter carefully.
What to check
Check ImageLoaded, Signed, Signature and the loading process.
How to turn it on
Sysmon configuration including ImageLoad, usually filtered to unsigned or unusual paths.
MITRE ATT&CK
- T1574.002 DLL Side-Loading
- T1129 Shared Modules