Potential TRUSTRAP DLL Sideloading from Non-Standard Writable Directory

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•0

Detects the loading of DLL files from user-writable or non-standard directories (e.g., AppData, Temp, ProgramData) that are often used in DLL sideloading attacks to hijack application search order. This rule identifies patterns associated with TRUSTRAP-style activity where a malicious DLL is placed in an adversary-controlled directory to be loaded by a legitimate application.