Creation Of Non-Existent System DLL For Hijacking

SigmaHQ Detections@sigmaHQ

•updated May 15, 2025•1•0•20

Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). This technique is commonly used to achieve DLL hijacking, which can lead to defense evasion, persistence, and privilege escalation.