Potential WWlib.DLL Sideloading

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•15

Detects potential DLL sideloading of 'wwlib.dll' by identifying instances where 'wwlib.dll' is loaded by an executable that is NOT a legitimate Microsoft Office Word process. This rule specifically filters out loads from standard Microsoft Office installation paths for 'winword.exe' to reduce false positives.