Microsoft Defender Blocked from Loading Unsigned DLL

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•27

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs. This activity may indicate an attempt to sideload arbitrary DLLs into legitimate Microsoft Defender processes, potentially for privilege escalation, persistence, or defense evasion.