Potential DLL Sideloading Using Coregen.exe

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•16

This rule detects potential DLL sideloading attempts using the 'coregen.exe' (Microsoft CoreCLR Native Image Generator) binary. It specifically looks for instances where 'coregen.exe' loads DLLs from locations other than the legitimate Microsoft Silverlight or Windows system directories (System32, SysWOW64). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate, signed Microsoft binary into loading their arbitrary DLL.