Potential Libvlc.DLL Sideloading
This rule detects potential DLL sideloading of 'libvlc.dll'. Adversaries may place a malicious 'libvlc.dll' in a directory that is searched before the legitimate VLC installation path, causing a legitimate application to load the malicious DLL instead of the intended one. This technique can be used for defense evasion, persistence, and privilege escalation. The rule specifically looks for 'libvlc.dll' being loaded from any location other than the default VLC installation directories.
Sigma
