Potential Antivirus Software DLL Sideloading

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•1•0•36

Detects potential DLL sideloading of DLLs that are part of antivirus software such as McAfee, Symantec, Bitdefender, F-Secure, CyberArk, Avast, ESET, and Trend Micro. The rule identifies when specific DLLs associated with these security products are loaded from an unexpected or non-standard directory, indicating a possible attempt to hijack the execution flow.