Skip to content
Threat Feed

Tag

Dll

2 briefs RSS
medium advisory

Suspicious PowerShell Module DLL Creation

The creation of a DLL file within PowerShell module directories can indicate malicious PowerShell activity, such as installing new modules or attempts at ScriptBlock smuggling, and this activity is detected using Sysmon Event ID 11.

Splunk Enterprise +2 powershell module dll filecreation scriptblocksmuggling
2r 3t
medium advisory

IOBit Unlocker Extension DLL Registration via Regsvr32

The IOBit Unlocker Extension DLL is being registered via regsvr32.exe, a Windows utility used to unlock files or folders by terminating locking processes, which could be abused for malicious purposes.

Unlocker Extension +3 iobit unlocker regsvr32 dll windows threat-detection
2r 1t