Potential DLL Sideloading of MpSvc.DLL

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

This rule detects potential DLL sideloading of 'MpSvc.dll'. It specifically looks for instances where 'MpSvc.dll' is loaded from a location other than the legitimate Windows Defender directories or the WinSxS directory. This technique can be used by adversaries to achieve persistence, escalate privileges, or evade defenses by tricking a legitimate application into loading a malicious DLL.