Malicious DLL File Dropped in Teams or OneDrive Folder

SigmaHQ Detections@sigmaHQ

•updated May 15, 2025•3•0•32

Detects the creation of a malicious DLL file named 'iphlpapi.dll' within the 'AppData\Local\Microsoft' directory, which is commonly used by applications like Microsoft Teams or OneDrive. This technique is often employed for DLL sideloading, where a legitimate application loads a malicious DLL placed in a specific directory, leading to code execution, persistence, privilege escalation, or defense evasion.