Potential Mpclient.DLL Sideloading by Windows Defender Processes

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•12

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") when the DLL is loaded from a non-default or unexpected directory. This technique can be used for privilege escalation, persistence, and defense evasion.