7 Sysmon log · Image Loaded medium severity very-high volume

Sysmon Event ID 7 — Image loaded

A DLL or executable image was loaded into a process. Image (target process), ImageLoaded (DLL path), Hashes, Signed, Signature are key.

Why event 7 matters

DLL hijacking — loading malicious DLLs from attacker-controlled paths before legitimate ones. DLL side-loading — legitimate executable loading attacker DLL. In-memory reflective DLL injection may not generate this event. Key: known malicious DLL names (e.g., version.dll, cryptbase.dll from non-system paths).

How to detect it

Alert: known DLL hijacking targets loaded from unexpected paths (not C:\Windows\System32). Alert: signed=false for DLLs loaded by privileged processes. Very high volume — use targeted rules for specific DLL+path combinations.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageImageLoadedSignedSignatureHashes

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Hijack Execution Flow: DLL Search Order Hijacking (T1574.001)
Defense Evasion Hijack Execution Flow: DLL Side-Loading (T1574.002)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: DLL Loaded from Suspicious Path
status: experimental
description: DLL loaded from user-writable or temp directory
author: theadminstack.com
date: 2026/05/16
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Signed: 'false'
        ImageLoaded|contains:
            - '\\Temp\\'
            - '\\AppData\\'
            - '\\Users\\'
    condition: selection
falsepositives:
    - Development builds
    - Some legitimate installers
level: medium
tags:
    - attack.defense_evasion
    - attack.t1574.001
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 7   // Image loaded
// EventData holds: Image, ImageLoaded, Signed, Signature, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Image loaded — add EventData fields: Image, ImageLoaded, Signed, Signature`
Hunt event 7 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 7?

Image loaded. A DLL or executable image was loaded into a process. Image (target process), ImageLoaded (DLL path), Hashes, Signed, Signature are key.

Which log records event 7?

Event 7 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 7?

Event 7 is associated with: Hijack Execution Flow: DLL Search Order Hijacking (T1574.001), Hijack Execution Flow: DLL Side-Loading (T1574.002).

How do you detect activity around event 7?

Alert: known DLL hijacking targets loaded from unexpected paths (not C:\Windows\System32). Alert: signed=false for DLLs loaded by privileged processes. Very high volume — use targeted rules for specific DLL+path combinations.