Scheduled Task DLL Sideloading
Detects a process launched by the Windows Task Scheduler from a non-standard directory that immediately loads a DLL from the same directory. This is a strong indicator of DLL Sideloading for persistence, as seen in campaigns by groups like ToddyCat.
YARA-L
