All Detections

Potential Mpclient.DLL Sideloading Via Defender Binaries

avatar
SigmaHQ Detections@sigmaHQ
updated Apr 28, 2026000

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Sigma