Grandoreiro DLL Side-Loading via Legitimate Binaries from AppData

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

This rule detects the loading of suspicious DLL files (commonly associated with MinGW or image processing libraries) from user-writable directories such as AppData or Temp. Loading these libraries from these non-standard locations, particularly when not initiated by a known legitimate process, may indicate DLL side-loading or execution of masqueraded malicious binaries.