Potential Mpclient.DLL Sideloading Via Defender Binaries

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects potential DLL sideloading of "mpclient.dll" by legitimate Windows Defender processes ("MpCmdRun.exe" and "NisSrv.exe") when they are executed from a non-standard directory. This technique can be used by adversaries to execute malicious code under the guise of a trusted process, potentially leading to privilege escalation, persistence, or defense evasion.