DotNET Assembly DLL Loaded Via Office Application

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects when a .NET assembly DLL from the Windows assembly cache (C:\Windows\assembly\) is loaded by a Microsoft Office application. This behavior can indicate an attempt to execute malicious code or achieve persistence through Office applications by leveraging .NET assemblies.