← Back to SOC feed Coverage →

Suspicious Image Load related to IcedId

kql MEDIUM Azure-Sentinel
DeviceImageLoadEvents
huntingmicrosoftofficialransomware
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-25T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may load malicious images as part of initial compromise or persistence, leveraging Azure container environments to evade traditional detection. SOC teams should proactively hunt for this behavior to identify and mitigate potential IcedId malware activity in their cloud infrastructure.

KQL Query

DeviceImageLoadEvents 
| where InitiatingProcessFileName in~ ('rundll32.exe','regsvr32.exe') 
| where FileName endswith '.txt' or FileName endswith '.pdf'

Analytic Rule Definition

id: b64c8a59-94ad-4659-b95e-36238312da5c
name: Suspicious Image Load related to IcedId
description: |
  Use this query to locate suspicious load image events by rundll32.exe or regsvr32.exe, a behavior associated with IcedId, which can lead to ransomware.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceImageLoadEvents
tactics:
- Execution
- Ransomware
query: |
  DeviceImageLoadEvents 
  | where InitiatingProcessFileName in~ ('rundll32.exe','regsvr32.exe') 
  | where FileName endswith '.txt' or FileName endswith '.pdf'

Required Data Sources

Sentinel TableNotes
DeviceImageLoadEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Ransomware/Suspicious Image Load related to IcedId.yaml