Unusual Toast Notification DLL Load

Tim Peck@timpeck

•updated Mar 25, 2026•3•0•66

Detects non-standard processes (e.g., command shells, script hosts) loading WinRT notification and push app libraries (wpnapps.dll, notificationcontroller.dll), which may indicate an implant or script attempting to send spoofed toast notifications for social engineering.