Windows XLL File Creation Outside of Typical Location — Detection Rule

Detects the creation of an XLL file outside of typical locations. This can indicate an attempt to abuse Excel COM objects to load and execute a malicious XLL.

Read the full analysis on IntelFusions