DLL Names Used By SVR For GraphicalProton Backdoor

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•24

This rule detects the loading of specific DLL names known to be used by the SVR-attributed GraphicalProton backdoor. The rule looks for an 'ImageLoaded' event where the DLL name ends with one of the predefined malicious DLL names.