Potential 7za.DLL Sideloading
Detects potential DLL sideloading of "7za.dll". This technique involves an attacker placing a malicious DLL (named 7za.dll in this case) in a location where a legitimate application expects to load a benign version of the DLL. By doing so, the malicious DLL is loaded and executed by the legitimate application, allowing the attacker to achieve defense evasion, persistence, or privilege escalation. The rule specifically looks for instances where '7za.dll' is loaded by an executable not residing in standard 'Program Files' directories, which are typically trusted locations.
Sigma
