Potential ShellDispatch.DLL Sideloading

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•12

Detects potential DLL sideloading of "ShellDispatch.dll" by monitoring image load events. The rule specifically looks for instances where 'ShellDispatch.dll' is loaded from locations other than typical legitimate temporary directories (like ':\Users\*\AppData\Local\Temp\' or ':\Windows\Temp\'), which could indicate malicious activity.