Aspose Email Assembly Loaded from Suspicious Location

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•1•0•5

This rule detects the loading of Aspose.Email DLLs from suspicious user-writable or temporary directories. This behavior is indicative of an attacker potentially using a legitimate library for malicious purposes, possibly to evade detection or to collect information, rather than an approved mail application loading it from its intended location.