Potential Arbitrary DLL Load Using Winword (f7375e28-5c14-432f-b8d1-1db26c832df3)
Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Indirect Command Execution - T1202 (3b0e52ce-517a-4614-a523-1bd5deef6c5e) | Attack Pattern | Potential Arbitrary DLL Load Using Winword (f7375e28-5c14-432f-b8d1-1db26c832df3) | Sigma-Rules | 1 |