Windows Unsigned DLL Side-Loading In Same Process Path

This detection identifies unsigned DLLs loaded through DLL side-loading where the DLL shares the same file path as the process that loaded it. This technique is observed in malware like DarkGate and PlugX. The rule monitors DLL loading events, verifies digital signatures, and flags unsigned DLLs. It specifically excludes DLLs loaded from standard Windows system directories and Program Files to reduce false positives. Detecting such suspicious DLLs is crucial in preventing privilege escalation and other security breaches.