Potential DLL SideLoading via ADNotificationManager

Daniel Koifman@Koifsec

•updated Mar 31, 2026•5•0•88

This rule detects the execution of 'ADNotificationManager.exe' or a process with 'ADNotificationManager.exe' as its original filename. It specifically excludes processes where the image filename contains 'acrobat' or 'reader'. This pattern is often associated with DLL side-loading techniques, where a legitimate application (like ADNotificationManager.exe) is used to load a malicious DLL.