Velvet Ant - IIS Worker Sideloading PlugX (T1505.003)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•3

Maps the attack path where the IIS worker process (w3wp.exe) executes certutil to download a payload, followed immediately by sideloading a malicious DLL into a signed binary. This rule specifically looks for `w3wp.exe` initiating `certutil.exe` and then a subsequent image load event where a DLL (`mscoree.dll`, `mpclient.dll`, or `oci.dll`) is loaded by a process with a valid signature.