GAC DLL Loaded Via Office Applications

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects when a DLL from the Global Assembly Cache (GAC) is loaded by a Microsoft Office application. This behavior can be indicative of malicious activity, such as DLL hijacking or persistence mechanisms, where an attacker might try to load their own malicious DLLs disguised as legitimate GAC assemblies through Office applications.