SOC Event Lookup
Event ID 7ImageP2

Sysmon Event ID 7: Image loaded

Applicable version
Sysmon 1.0 and later (ImageLoad must be enabled in Sysmon config)
Last reviewed
2026-07-21

Quick summary

Sysmon Event ID 7 records every DLL or executable image loaded into a process's address space, capturing the loading process, the loaded file path, its hashes, and its Authenticode signature status.

Technical Metadata

Technical metadata for Event ID 7
Event ID7
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0003 Persistence / T1574.001 DLL Search Order Hijacking
Key fields to watchImageLoaded, SignatureStatus / Signed, Image, OriginalFileName, Hashes

Trigger Scenarios

Sysmon generates Event ID 7 on every LoadLibrary-family call when ImageLoad monitoring is enabled. Volume is extremely high on active systems; Sysmon configurations almost always filter this event down to high-value targets such as lsass.exe, security tools, or untrusted load paths.

Key Fields

ImageLoaded

Full path of the DLL or image being loaded. A load from %TEMP%, %APPDATA%, %USERPROFILE%, or a UNC path into a privileged process is the central indicator of DLL hijacking or side-loading.

SignatureStatus / Signed

Authenticode validation result. Signed=false or SignatureStatus other than "Valid" for a DLL loaded into a security-sensitive process (lsass.exe, svchost.exe, explorer.exe) means an unsigned image entered a high-privilege address space.

Image

The process loading the DLL. lsass.exe loading a non-system DLL, or a signed Windows binary loading from an unexpected path, are the archetypal patterns for credential-access tooling and defense-evasion via DLL side-loading.

OriginalFileName

The filename embedded in the DLL's version resource. A mismatch between OriginalFileName and the on-disk filename (e.g., a file named version.dll whose OriginalFileName is calc.dll) reveals a renamed masquerading DLL.

Hashes

SHA256/IMPHASH of the loaded image. Cross-reference against threat-intelligence blocklists and LOLBins lists to identify known-malicious or abusable libraries.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 7
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 7
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 7
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
| table _time, host, EventCode, Message
Data source
Splunk Sysmon event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the event-specific field conditions after validating local field extraction.
Cortex XQL: Retrieve Sysmon Event ID 7
dataset = microsoft_windows_raw
| filter edr_event_id = 7
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Sysmon Event ID 7
title: Sysmon Event ID 7
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented field conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID7A module loaded into a process; this telemetry is disabled by default unless configured.Use EventID together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source
SignedfalseSysmon reports that the loaded image is not signed; this is context, not proof of maliciousness.Use Signed together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1574.001DLL Search Order Hijacking

Detection Notes

T1574.001 DLL hijacking is concrete when Image is a signed system binary but ImageLoaded is an unsigned DLL from C:\\Users\\, C:\\ProgramData\\, or C:\\Temp\\. Sysmon Event 7 is disabled by default, so collection scope must be explicit.

Common False Positives

  • Software installers temporarily extract DLLs to %TEMP% before loading them; short-lived loads during installation are generally benign.
  • Some legitimate applications load DLLs from user profile directories by design (e.g., browser plugins, certain Java JREs).
  • Developer tools and debuggers load unsigned DLLs for legitimate instrumentation purposes.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-12 11:03:45.882
ProcessGuid: {11111111-2222-3333-4444-555555555555}
ProcessId: 812
Image: C:\Windows\System32\lsass.exe
ImageLoaded: C:\Windows\Temp\dbghelp.dll
Hashes: SHA256=REDACTED
Signed: false
Signature: -
SignatureStatus: Unsigned
User: NT AUTHORITY\SYSTEM
OriginalFileName: dbghelp.dll

Frequently Asked Questions

What does Sysmon Event ID 7 mean?

A DLL or executable image loaded into a process address space.

Does Event ID 7 always indicate malicious activity?

It is disabled by default and can be high volume, so collection requires scoped ImageLoad filters.

How should Event ID 7 be investigated?

Compare Image with ImageLoaded, signature and hash data, expected module paths, and ProcessGuid-linked process creation.

Sources

Machine-readable JSON