Deletion of Mistic Sideloading Artifacts

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•1•0•7

Detects the deletion of specific files associated with Mistic sideloading artifacts ('EndpointDlp.dll' or 'MpExtMs.exe') using command-line utilities such as cmd.exe or PowerShell. This behavior is indicative of an adversary attempting to remove forensic traces or secondary payloads after initial compromise.