Reflective Loading of EndpointDlp.dll by MpExtMs.exe

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•0•0•3

This rule detects the suspicious behavior where the process 'MpExtMs.exe' loads the 'EndpointDlp.dll' library into memory without any corresponding file creation or modification events for that DLL. This pattern is indicative of reflective code loading or fileless execution techniques often associated with Backdoor.Mistic (MLTBackdoor), where malicious code is executed directly from memory to evade disk-based security controls.