Skip to content

Hide Navigation Hide TOC

Potential Mpclient.DLL Sideloading (418dc89a-9808-4b87-b1d7-e5ae0cb6effc)

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Cluster A Galaxy A Cluster B Galaxy B Level
DLL Side-Loading - T1574.002 (e64c62cf-9cd7-4a14-94ec-cdaac43ab44b) Attack Pattern Potential Mpclient.DLL Sideloading (418dc89a-9808-4b87-b1d7-e5ae0cb6effc) Sigma-Rules 1
DLL Side-Loading - T1574.002 (e64c62cf-9cd7-4a14-94ec-cdaac43ab44b) Attack Pattern Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6) Attack Pattern 2