Execution of Possible Mpclient.DLL Sideloading Through OfflineScannerShell.EXE (via process_creation)

title: Execution of Possible Mpclient.DLL Sideloading Through OfflineScannerShell.EXE (via process_creation)
id: 1f817878-db2a-579e-a9d0-f8ece4934eaf
status: stable
description: This rule detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory. The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory.
references:
    - https://attack.mitre.org/techniques/T1218/
    - https://lolbas-project.github.io/lolbas/Binaries/OfflineScannerShell/
author: Huntrule Team
date: 2026-07-03
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\OfflineScannerShell.exe'
        - OriginalFileName: 'OfflineScannerShell.exe'
    filter_main_legit_dir:
        CurrentDirectory: 'C:\Program Files\Windows Defender\Offline\'
    filter_main_empty:
        CurrentDirectory: ''
    filter_main_null:
        CurrentDirectory:
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium