Potential DLL Sideloading of Libcurl.DLL via GUP.EXE

SigmaHQ Detections@sigmaHQ

•updated May 15, 2025•4•0•44

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location. This technique can be used by adversaries to execute malicious code by tricking a legitimate application into loading a malicious DLL instead of its legitimate counterpart.