Potential DLL Sideloading Via comctl32.dll

SigmaHQ Detections@sigmaHQ

•updated May 15, 2025•0•17

Detects potential DLL sideloading using comctl32.dll by monitoring specific Windows executables loading this DLL from a '.local' directory, which is a common technique for privilege escalation and defense evasion.