SloppyLemming DLL Sideloading via Hijacked Microsoft Binaries

Brandon Rodriguez@BMRodriguez

•updated Mar 12, 2026•6•0•60

Detects the execution of legitimate Microsoft binaries, NGenTask.exe or phoneactivate.exe (often renamed), from non-standard, user-writable directories. This is a known DLL Sideloading technique used by the threat actor SloppyLemming.