If you are threat hunting, the easiest way to hunt for DLL sideloads is to check the path of the process. Most red teams will run their payloads from C:\programdata, Temp, Public, Appdata or from desktop. Most windows applications don't run from these locations unless until they are C# applications. And if you find some signed process suspicious, you can always check the file creation time to validate if it was recently copied to the host. Unsigned DLLs are an easy give away. For the red teams, note that Microsoft itself doesn't sign all their DLLs. This means if you simply add telemetry to your DLL to make it look like a genuine company, you would be able to evade most hunts. Also, please don't use built-in Microsoft binaries and run them from abnormal locations. There are several other better sideloads from Cisco/Citrix and generic IT apps which work much better than the MS ones. #RedAndBlueTips