Microsoft Office DLL Sideload from Non-Standard Location

SigmaHQ Detections@sigmaHQ

•updated May 15, 2025•0•22

Detects the loading of Microsoft Office DLLs, specifically 'outllib.dll', from non-standard file system locations. This behavior is indicative of DLL sideloading, a technique used by adversaries for defense evasion, persistence, and privilege escalation.