Threat: DLL Side-Load | Detection.FYI

Potential DLL Side-Loading via Trusted Microsoft Programs

Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Tactic: Execution Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Sysmon Data Source: Microsoft Defender XDR Resources: Investigation Guide Data Source: Crowdstrike Data Source: SentinelOne Noise: High Performance: Normal Profile: Aggressive Threat: DLL Side-Load Rule Type: Event Correlation (EQL) Platform: Windows ·
Share on:

Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes.

Read More
Unsigned DLL Side-Loading from a Suspicious Folder

Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Data Source: Elastic Defend Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: DLL Side-Load Rule Type: Event Correlation (EQL) Platform: Windows ·
Share on:

Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of a signed processes.

Read More