| sigma |
Potential Antivirus Software DLL Sideloading |
test |
2026-10-19 |
| splunk |
Windows DLL Search Order Hijacking Hunt with Sysmon |
production |
2026-10-02 |
| splunk |
Windows Known Abused DLL Created |
production |
2026-09-22 |
| splunk |
Windows Known Abused DLL Loaded Suspiciously |
production |
2026-09-22 |
| elastic |
Potential DLL Side-Loading via Trusted Microsoft Programs |
production |
2026-09-18 |
| elastic |
Untrusted DLL Loaded by Azure AD Connect Authentication Agent |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt via Privileged IFileOperation COM Interface |
production |
2026-09-18 |
| elastic |
Suspicious DLL Loaded for Persistence or Privilege Escalation |
production |
2026-09-18 |
| elastic |
WPS Office Exploitation via DLL Hijack |
production |
2026-09-18 |
| elastic |
Unsigned DLL Side-Loading from a Suspicious Folder |
production |
2026-09-18 |
| elastic |
Potential Windows Session Hijacking via CcmExec |
production |
2026-09-18 |
| elastic |
Potential Masquerading as System32 DLL |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft Antimalware Service Execution |
production |
2026-09-18 |
| elastic |
Suspicious Antimalware Scan Interface DLL |
production |
2026-09-18 |
| elastic |
Execution via local SxS Shared Module |
production |
2026-09-18 |
| sigma |
Unsigned .node File Loaded |
experimental |
2026-08-27 |
| splunk |
Windows SCCM Smsexec Spawned a Suspicious Child Process |
production |
2026-08-24 |
| splunk |
Windows Phantom DLL Created on Disk |
production |
2026-08-20 |
| elastic |
Deprecated - Suspicious PrintSpooler Service Executable File Creation |
deprecated |
2026-08-19 |
| sigma |
Potential System DLL Sideloading From Non System Locations |
test |
2026-07-10 |
| sigma |
Signed DLL Loaded With Missing PE Version Metadata |
experimental |
2026-05-21 |
| sigma |
Creation of WerFault.exe/Wer.dll in Unusual Folder |
test |
2026-05-18 |
| sigma |
Potential Vcruntime140 DLL Sideloading |
experimental |
2026-05-18 |
| splunk |
Msmpeng Application DLL Side Loading |
production |
2026-05-13 |
| splunk |
Windows Unsigned MS DLL Side-Loading |
production |
2026-05-13 |
| splunk |
Windows Unsigned DLL Side-Loading In Same Process Path |
production |
2026-05-13 |
| splunk |
Windows Unsigned DLL Side-Loading |
production |
2026-05-13 |
| splunk |
Windows SqlWriter SQLDumper DLL Sideload |
production |
2026-05-13 |
| splunk |
MSI Module Loaded by Non-System Binary |
production |
2026-05-13 |
| splunk |
Windows DLL Side-Loading In Calc |
production |
2026-05-13 |
| splunk |
Windows DLL Search Order Hijacking with iscsicpl |
production |
2026-05-13 |
| splunk |
Windows Mustang Panda USB Tool Execution |
production |
2026-05-13 |
| splunk |
Windows Masquerading Explorer As Child Process |
production |
2026-05-13 |
| splunk |
Windows Known GraphicalProton Loaded Modules |
production |
2026-05-13 |
| splunk |
Windows Hijack Execution Flow Version Dll Side Load |
production |
2026-05-13 |
| splunk |
Windows DLL Side-Loading Process Child Of Calc |
production |
2026-05-13 |
| sigma |
System Control Panel Item Loaded From Uncommon Location |
test |
2026-02-17 |
| sigma |
Registry Modification for OCI DLL Redirection |
experimental |
2026-01-24 |
| sigma |
Potential DLL Sideloading Of Non-Existent DLLs From System Folders |
test |
2026-01-24 |
| sigma |
Creation Of Non-Existent System DLL |
test |
2026-01-24 |
| sigma |
Potential Goopdate.DLL Sideloading |
test |
2025-10-07 |
| sigma |
Potential DLL Sideloading Of DBGHELP.DLL |
test |
2025-10-07 |
| sigma |
Potential JLI.dll Side-Loading |
experimental |
2025-10-06 |
| sigma |
Potential DLL Sideloading Of DBGCORE.DLL |
test |
2025-10-06 |
| sigma |
Potential Python DLL SideLoading |
test |
2025-08-18 |
| sigma |
Potential DLL Sideloading Of MsCorSvc.DLL |
test |
2025-02-26 |
| sigma |
Xwizard.EXE Execution From Non-Default Location |
test |
2024-08-15 |
| sigma |
Potential Raspberry Robin Aclui Dll SideLoading |
test |
2024-07-31 |
| sigma |
Potential DLL Sideloading Of DbgModel.DLL |
test |
2024-07-22 |
| sigma |
Potential DLL Sideloading Of MpSvc.DLL |
test |
2024-07-11 |
| sigma |
HackTool - Powerup Write Hijack DLL |
test |
2024-06-27 |
| sigma |
Potentially Suspicious Child Process of KeyScrambler.exe |
test |
2024-05-13 |
| sigma |
Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE |
test |
2024-04-15 |
| sigma |
DLL Names Used By SVR For GraphicalProton Backdoor |
test |
2023-12-18 |
| sigma |
Suspicious Unsigned Thor Scanner Execution |
stable |
2023-10-29 |
| sigma |
Diamond Sleet APT DLL Sideloading Indicators |
test |
2023-10-24 |
| sigma |
Lazarus APT DLL Sideloading Activity |
test |
2023-10-18 |
| sigma |
VMMap Signed Dbghelp.DLL Potential Sideloading |
test |
2023-09-05 |
| sigma |
VMMap Unsigned Dbghelp.DLL Potential Sideloading |
test |
2023-09-05 |
| sigma |
New DNS ServerLevelPluginDll Installed |
test |
2023-08-17 |
| sigma |
DHCP Callout DLL Installation |
test |
2023-08-17 |
| sigma |
Unsigned Mfdetours.DLL Sideloading |
test |
2023-08-11 |
| sigma |
Potential Mpclient.DLL Sideloading |
test |
2023-08-04 |
| sigma |
Potential Mpclient.DLL Sideloading Via Defender Binaries |
test |
2023-08-04 |
| sigma |
Potential Mfdetours.DLL Sideloading |
test |
2023-08-03 |
| sigma |
Potential Vivaldi_elf.DLL Sideloading |
test |
2023-08-03 |
| sigma |
Potential EACore.DLL Sideloading |
test |
2023-08-03 |
| sigma |
Potential AVKkid.DLL Sideloading |
test |
2023-08-03 |
| sigma |
Potential CCleanerDU.DLL Sideloading |
test |
2023-07-13 |
| sigma |
Potential CCleanerReactivator.DLL Sideloading |
test |
2023-07-13 |
| sigma |
Potential appverifUI.DLL Sideloading |
test |
2023-06-20 |
| sigma |
Potential ShellDispatch.DLL Sideloading |
test |
2023-06-20 |
| sigma |
Potential Waveedit.DLL Sideloading |
test |
2023-06-14 |
| sigma |
Potential Edputil.DLL Sideloading |
test |
2023-06-09 |
| sigma |
Potential RjvPlatform.DLL Sideloading From Non-Default Location |
test |
2023-06-09 |
| sigma |
Potential 7za.DLL Sideloading |
test |
2023-06-09 |
| sigma |
Potential RjvPlatform.DLL Sideloading From Default Location |
test |
2023-06-09 |
| sigma |
Unsigned Module Loaded by ClickOnce Application |
test |
2023-06-08 |
| sigma |
Potential SmadHook.DLL Sideloading |
test |
2023-06-01 |
| sigma |
Small Sieve Malware CommandLine Indicator |
test |
2023-05-19 |
| sigma |
Potential WWlib.DLL Sideloading |
test |
2023-05-18 |
| sigma |
Potential Chrome Frame Helper DLL Sideloading |
test |
2023-05-15 |
| sigma |
Potential RoboForm.DLL Sideloading |
test |
2023-05-14 |
| sigma |
Potential Wazuh Security Platform DLL Sideloading |
test |
2023-05-12 |
| sigma |
Potential SolidPDFCreator.DLL Sideloading |
test |
2023-05-07 |
| sigma |
Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE |
test |
2023-05-05 |
| sigma |
Potential Azure Browser SSO Abuse |
test |
2023-04-18 |
| sigma |
Potential Libvlc.DLL Sideloading |
test |
2023-04-17 |
| sigma |
Potential Iviewers.DLL Sideloading |
test |
2023-03-21 |
| sigma |
Aruba Network Service Potential DLL Sideloading |
test |
2023-03-15 |
| sigma |
Microsoft Office DLL Sideload |
test |
2023-03-15 |
| sigma |
Potential Rcdll.DLL Sideloading |
test |
2023-03-15 |
| sigma |
APT27 - Emissary Panda Activity |
test |
2023-03-09 |
| sigma |
Pingback Backdoor Activity |
test |
2023-02-17 |
| sigma |
Pingback Backdoor DLL Loading Activity |
test |
2023-02-17 |
| sigma |
Pingback Backdoor File Indicators |
test |
2023-02-17 |
| sigma |
Potential DLL Sideloading Via VMware Xfer |
test |
2023-02-17 |
| sigma |
DNS Server Error Failed Loading the ServerLevelPluginDLL |
test |
2023-02-05 |
| sigma |
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE |
test |
2023-02-05 |
| sigma |
Potential DLL Sideloading Via DeviceEnroller.EXE |
test |
2023-02-04 |
| sigma |
Potential PlugX Activity |
test |
2023-02-03 |
| sigma |
Renamed Vmnat.exe Execution |
test |
2023-02-03 |
| sigma |
Use Of Hidden Paths Or Files |
test |
2022-12-30 |
| sigma |
DHCP Server Error Failed Loading the CallOut DLL |
test |
2022-12-25 |
| sigma |
UAC Bypass With Fake DLL |
test |
2022-12-25 |
| sigma |
DHCP Server Loaded the CallOut DLL |
test |
2022-12-25 |
| sigma |
Tasks Folder Evasion |
test |
2022-12-25 |
| sigma |
Potential DLL Sideloading Via comctl32.dll |
test |
2022-12-19 |
| sigma |
Potential DLL Sideloading Via JsSchHlp |
test |
2022-12-14 |
| sigma |
Potential DLL Sideloading Via ClassicExplorer32.dll |
test |
2022-12-13 |
| sigma |
VMGuestLib DLL Sideload |
test |
2022-12-01 |
| sigma |
DLL Sideloading Of ShellChromeAPI.DLL |
test |
2022-12-01 |
| sigma |
Potential Initial Access via DLL Search Order Hijacking |
test |
2022-10-21 |
| sigma |
Microsoft Defender Blocked from Loading Unsigned DLL |
test |
2022-09-28 |
| sigma |
Unsigned Binary Loaded From Suspicious Location |
test |
2022-09-28 |
| sigma |
Third Party Software DLL Sideloading |
test |
2022-08-17 |
| sigma |
Suspicious GUP Usage |
test |
2022-08-13 |
| sigma |
Malicious DLL File Dropped in the Teams or OneDrive Folder |
test |
2022-08-12 |
| sigma |
DLL Sideloading by VMware Xfer Utility |
test |
2022-08-02 |
| sigma |
DLL Search Order Hijackig Via Additional Space in Path |
test |
2022-07-30 |
| sigma |
Fax Service DLL Search Order Hijack |
test |
2022-06-02 |
| sigma |
Winnti Malware HK University Campaign |
test |
2021-11-27 |
| sigma |
Winnti Pipemon Characteristics |
stable |
2021-11-27 |