Skip to content
Threat Feed

Tag

Dll-Sideloading

2 briefs RSS
medium advisory

Unsigned DLL Side-Loading from Suspicious Folders by Trusted Processes

This detection identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted program and loading a recently dropped unsigned DLL, which indicates an attempt to evade defenses via side-loading a malicious DLL within the memory space of a signed process.

Elastic Defend defense-evasion dll-sideloading windows
2r 2t
high threat

Potential Vcruntime140 DLL Sideloading

Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library, often used by threat actors like APT29 (via WinELOADER) to load malicious payloads under the guise of legitimate applications, leading to defense evasion, persistence, and privilege escalation.

Visual C++ Redistributable APT29 +5 dll-sideloading vcruntime140.dll wineloader defense-evasion persistence privilege-escalation
2r 3t