Mustang Panda ClaimLoader DLL Sideloading

Tim Peck@timpeck

•updated Oct 8, 2025•0•100

Detects DLL side-loading activity consistent with the Mustang Panda Claimloader malware. This rule looks for a process loading a DLL from its own directory, a common side-loading pattern. It specifically targets IOCs from the Claimloader campaign (e.g., decoy executable metadata and malicious DLL names) or a more generic pattern where an executable in a suspicious location loads a DLL.