Tag
Potential DLL Side-Loading via Trusted Microsoft Programs
2 rules 2 TTPsThis rule detects potential DLL side-loading attempts by identifying instances of Windows trusted programs (WinWord.exe, EXPLORER.EXE, w3wp.exe, DISM.EXE) being started after being renamed or from a non-standard path, which is a common technique to evade defenses by side-loading a malicious DLL into the memory space of a trusted process.
Untrusted DLL Loaded by Azure AD Connect Authentication Agent
2 rules 1 TTPThe loading of an untrusted DLL by the Azure AD Connect Authentication Agent, potentially indicating credential access attempts via the Pass-through Authentication service, is detected by this rule.
Potential DLL Side-Loading via Trusted Microsoft Programs
2 rules 2 TTPsThis rule detects potential DLL side-loading attempts by identifying trusted Microsoft programs (WinWord.exe, EXPLORER.EXE, w3wp.exe, DISM.EXE) running from non-standard paths or after being renamed to evade defenses.
Suspicious Microsoft Antimalware Service Execution
2 rules 3 TTPsDetection of Microsoft Antimalware Service Executable (MsMpEng.exe) executing from non-standard paths or being renamed, indicative of defense evasion via DLL side-loading or process masquerading.