APT27 - Emissary Panda DLL Side-Loading Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•23

Detects the execution of DLL side-loading malware used by the threat group Emissary Panda, also known as APT27. Specifically, it looks for `svchost.exe` being spawned by `sllauncher.exe` or `svchost.exe` being spawned from a user's `AppData\Roaming` directory with the `-k` command-line argument, which are indicators of this specific malware's behavior.