SYSTEM dllhost.exe loads planted DLL from ProgramData (CrossDevice COM hijack)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects the loading of an unsigned or attacker-controlled DLL into a SYSTEM-context dllhost.exe process, consistent with the exploitation of dangling COM CrossDevice CLSIDs (e.g., forcing ICreateObject::Proc3 to LoadLibrary from a C:\ProgramData location).