Potential Chrome Frame Helper DLL Sideloading

SigmaHQ Detections@sigmaHQ

•updated May 15, 2025•0•17

This rule detects potential DLL sideloading of "chrome_frame_helper.dll". It triggers when "chrome_frame_helper.dll" is loaded from a location other than the legitimate Google Chrome application directories (C:\Program Files\Google\Chrome\Application\ or C:\Program Files (x86)\Google\Chrome\Application\) or the user's local AppData path for Chrome.