Windows mpclient.dll Sideloading via MpCmdRun.exe or NisSrv.exe from Non-Default Paths

Alerts when mpclient.dll is loaded by MpCmdRun.exe or NisSrv.exe outside known Windows Defender directories.

FreeReviewedSigma · High · v2

Product: windows
Category: image_load
Author: Bhabesh Raj (SigmaHQ), DRL 1.1
Published: 2022-08-02
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1574.001DLL
Defense Evasion
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags image loads of mpclient.dll when performed by Windows Defender-related processes MpCmdRun.exe and NisSrv.exe from directories outside common, expected locations. Sideloading a DLL from an atypical path can allow an attacker to run malicious code under the context of a trusted binary, supporting persistence and stealth. It relies on Windows image load telemetry capturing the loaded DLL path and the importing process image path.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)

Suspicious Cortex XDR Binary Sideloading winutils.dll (via image_load)

Suspicious CoinLoader DLL Sideload From Z-1-36-81 Directory (via image_load)

Windows mpclient.dll Sideloading via MpCmdRun.exe or NisSrv.exe from Non-Default Paths

Pivot detection · T1574.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-mpclient-dll-side-loading-via-mpcmdrun-exe-or-nissrv-exe-from-non-defaul-418dc89a

title: Windows mpclient.dll Sideloading via MpCmdRun.exe or NisSrv.exe from Non-Default Paths
id: fd48707b-194e-406a-bcb8-d088c938a0d3
related:
  - id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9
    type: similar
  - id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc
    type: derived
status: test
description: This rule flags image loads of mpclient.dll when performed by Windows Defender-related processes MpCmdRun.exe and NisSrv.exe from directories outside common, expected locations. Sideloading a DLL from an atypical path can allow an attacker to run malicious code under the context of a trusted binary, supporting persistence and stealth. It relies on Windows image load telemetry capturing the loaded DLL path and the importing process image path.
references:
  - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_windows_defender.yml
author: Bhabesh Raj, Huntrule Team
date: 2022-08-02
modified: 2023-08-04
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    ImageLoaded|endswith: \mpclient.dll
    Image|endswith:
      - \MpCmdRun.exe
      - \NisSrv.exe
  filter_main_known_locations:
    Image|startswith:
      - C:\Program Files (x86)\Windows Defender\
      - C:\Program Files\Microsoft Security Client\
      - C:\Program Files\Windows Defender\
      - C:\ProgramData\Microsoft\Windows Defender\Platform\
      - C:\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL