Threat Hunt: APT35 - Subtle Snail style DLL Side-Loading - Advance
Detects high-fidelity DLL side-loading in user-writable folders (Downloads, AppData, Temp) where an unsigned or untrusted DLL—created shortly before it is loaded—is executed by a trusted, signed process. This query correlates DLL load timing, signature metadata, and parent process trust to surface sophisticated attack chains, such as those used by Subtle Snail and Lazarus APT groups.
Microsoft Sentinel (KQL)
