DLL sideloading attack using Xwizard

Xwizard has a known DLL-sideloading vulnerability, which involves moving the legitimate Xwizard.exe file into a new directory along with a malicious Xwizard.dll file. This is a possible indicator of an attacker preparing to execute a DLL-sideloading attack.

Module:

Platform Analytics

Agent event type:

Process execution

Category:

Evasion

Status:

Enabled