All Detections

Potential Arbitrary DLL Load Using Winword

avatar
SigmaHQ Detections@sigmaHQ
updated Apr 28, 2026000

Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.

Sigma