Unsigned/Untrusted DLL Loaded from Suspicious Path
This rule detects the loading of unsigned or untrusted DLLs from suspicious, non-standard file paths into a set of common Windows processes. It correlates DLL load events with recent process executions to identify potentially malicious shared module usage, often indicative of DLL hijacking or side-loading techniques. The rule specifically looks for DLLs loaded from paths like \Users\Public\, \Temp\, \AppData\, \ProgramData\, \Downloads\, and \PerfLogs\, into processes such as explorer.exe, svchost.exe, lsass.exe, and common applications like chrome.exe or winword.exe. It then filters these events to only include DLLs that are either unsigned or untrusted, and whose signer is not part of a predefined list of trusted entities (e.g., Microsoft, Google).
Microsoft Sentinel (KQL)
