Potential Initial Access via DLL Search Order Hijacking

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•28

Detects attempts to create a DLL file in known desktop application dependencies folders (e.g., Slack, Teams, OneDrive) by an unusual process. This activity may indicate an adversary attempting to load a malicious module via DLL search order hijacking for persistence, privilege escalation, or defense evasion.