Hunting for Suspicious Windows Libraries for Execution and Defense Evasion

Elastic describes common malicious DLL delivery and sideloading techniques (e.g., Rundll32/Regsvr32 abuse, ISO/VHD-based payloads, DLL extraction from Office documents, lolbins, MSIEXEC, archive/removable-device sideloading) and provides detection guidance including EQL queries, endpoint behavior protection rules, and metadata enrichments to reduce noise and improve fidelity when hunting for DLL image loads.