Dohdoor Suspicious Argument Passing to LOLBins

Ethan Andrews@eandrews

•updated Feb 26, 2026•4•0•72

Detects the execution of legitimate Windows binaries with command-line arguments containing URL patterns. This is a technique used by the Dohdoor malware campaign to pass C2 information to a sideloaded malicious DLL.