Malicious DLL File Dropped in the Teams or OneDrive Folder

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded