DLL Side-Loading via Microsoft Office dropped file

Identifies Microsoft Office process creating a DLL or other variant of an executable object which is later loaded by a trusted binary. Adversaries may exploit this behavior by delivering malicious modules via Microsoft Office documents.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Evasión de defensas
• Técnicas MITRE: T1574, T1574.002

Volver a todas las reglas