CldApi DLL loaded by an unusual process

Detects the loading of cldapi.dll (Cloud Filter API) by processes other than those legitimately associated with Windows Cloud Files infrastructure and OneDrive sync functionality. Adversaries may abuse the Cloud Filter API to hijack execution flow and evade defenses, for example by exploiting BindLink or redirector mechanisms to sideload malicious code into trusted processes or redirect file system operations.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Evasión de defensas
• Técnicas MITRE: T1574

Volver a todas las reglas