Shared DLL Module Loaded via Remote Network Path

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects attempts to load a DLL module from a remote network path over SMB. It specifically looks for traffic on port 445 (SMB) containing both ".dll" and "\\" (indicating a network path) in a case-insensitive manner. This behavior is often associated with trojan activity or other forms of malicious execution where an attacker might try to load a malicious DLL from a shared network drive.