Potential DLL SideLoading via DlpUserAgent

Daniel Koifman@Koifsec

•updated Mar 31, 2026•6•0•114

This rule detects the execution of 'DlpUserAgent.exe' from an unusual path, specifically excluding the Windows Defender directory. This executable is often associated with Data Loss Prevention (DLP) software, but its execution outside of expected system directories can indicate potential DLL side-loading or other forms of execution hijacking. The rule looks for process creation events where the image file name or original file name matches 'DlpUserAgent.exe' and the path is not within the Windows Defender directory.