Pingback Backdoor DLL Loading Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•21

Detects the loading of 'oci.dll' by 'msdtc.exe', which is indicative of the Pingback backdoor. This backdoor is known to establish an ICMP tunnel for command and control communication.