Potential DLL Sideloading Via JsSchHlp

SigmaHQ Detections@sigmaHQ

•updated May 15, 2025•0•13

This rule detects potential DLL sideloading activity involving the 'JSESPR.dll' library when it is loaded from a location other than the legitimate 'C:\Program Files\Common Files\Justsystem\JsSchHlp\' directory. This specific behavior is associated with the JUSTSYSTEMS Japanese word processor and has been observed in campaigns like 'Operation LiberalFace' targeting Japanese political entities.