Skip to content
Threat Feed

Product

W3wp.exe

1 brief RSS
medium advisory

Potential DLL Side-Loading via Trusted Microsoft Programs

This rule detects potential DLL side-loading attempts by identifying instances of Windows trusted programs (WinWord.exe, EXPLORER.EXE, w3wp.exe, DISM.EXE) being started after being renamed or from a non-standard path, which is a common technique to evade defenses by side-loading a malicious DLL into the memory space of a trusted process.

WinWord.exe +4 defense-evasion execution dll-side-loading windows
2r 2t