Potential Waveedit.DLL Sideloading

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•17

Detects potential DLL sideloading of "waveedit.dll" when loaded by an executable outside of the legitimate Nero WaveEditor installation paths. This technique is often used by adversaries for persistence, privilege escalation, and defense evasion.