Potential Goopdate.DLL Sideloading

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe. This rule aims to identify instances where this specific DLL is loaded from unexpected or non-standard locations, which could indicate malicious activity such as persistence, defense evasion, or privilege escalation through DLL sideloading.