Threat Hunt: APT35 - Subtle Snail style DLL Side-Loading - Basic
Detects potential Subtle Snail-style DLL side-loading attacks where an unsigned or untrusted DLL is loaded by a signed and trusted parent process from user-writable directories (Downloads, AppData, Temp). This method highlights signature-mismatch scenarios often leveraged by APT and malware actors to stealthily execute malicious code while bypassing traditional defenses.
Microsoft Sentinel (KQL)
