Diamond Sleet APT DLL Sideloading Indicators
This rule detects specific DLL sideloading activity observed to be used by the Diamond Sleet APT group. It looks for the loading of 'Version.dll' by 'clip.exe' or 'DSROLE.dll' by 'wsmprovhost.exe' when these executables and DLLs are located in the 'ProgramData' directory. This behavior is indicative of an adversary attempting to execute malicious code by tricking legitimate applications into loading their crafted DLLs.
Sigma
