hightestEmerging Threat
Lazarus APT DLL Sideloading Activity
Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company
windowsimage_load
2026-11-02
Emerging Threats
Actor2023, 2020, 2017
Lazarus
3Rules
5References
3Folders
2026-11-02Latest
Summary
Lazarus is tracked here as a threat actor, intrusion set, or campaign with 3 Sigma detections spanning 2023, 2020, 2017. Coverage centers on windows / process_creation, windows / image_load.
Related Detections
Search this threatcriticaltestEmerging Threat
Lazarus Group Activity
Detects different process execution behaviors as described in various threat reports on Lazarus group activity
windowsprocess_creation
2023-03-10
hightestEmerging Threat
Lazarus System Binary Masquerading
Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location
windowsprocess_creation
2023-03-10
References