DLL Search-Order Hijacking Side-Loads MiniBrowse via MiniJunk/TRUSTRAP

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•3

This rule detects the loading of DLL modules from non-standard system directories (outside of Windows, System32, SysWOW64, or Program Files) by signed processes, or the loading of files with known suspicious filenames such as 'MiniJunk' or 'TRUSTRAP'. This behavior is indicative of potential DLL sideloading, search order hijacking, or the loading of malicious payloads masquerading as legitimate libraries.