Potential DLL Sideloading Of MsCorSvc.DLL

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects potential DLL sideloading of "mscorsvc.dll" by identifying instances where this DLL is loaded from a location other than the standard Microsoft .NET Framework or WinSxS directories. This behavior can indicate an attacker attempting to execute malicious code by tricking a legitimate application into loading a rogue DLL.