SugarWraith Loader DLL Detection
This rule detects the SugarWraith loader DLL, which is associated with the UNK_SweetSpector threat group. It identifies the malware based on a combination of specific strings found within the binary, including error messages related to process and pipe creation, system information gathering strings, and network-related strings like "ngrok-skip-browser-warning" and "SecureProtocols". The presence of at least four of these strings indicates the potential presence of the SugarWraith loader.
YARA
