Potentially Suspicious Load of Cldapi DLL

Aziz Farghly

Detects the potential suspicious loading of the Cldapi.dll, which is associated with Windows Cloud Files API. While Cldapi.dll is a legitimate system component, its loading can be abused by attackers to execute code in the context of trusted processes or escalate privilege like in Green Plasma.

2026-05-27 00:00:00

None

0d0a1f9b-3c54-4f1c-b15d-1c0a9c1b7d54

attack.privilege-escalation attack.t1068

Nextron Sigma feed only (private)