Potential RoboForm DLL Sideloading
Detects potential DLL sideloading of 'roboform.dll' or 'roboform-x64.dll' when loaded by an executable that is not the legitimate RoboForm application (robotaskbaricon.exe or robotaskbaricon-x64.exe) or is loaded from an unexpected path outside of the standard RoboForm installation directories. This technique can be used for persistence, defense evasion, and privilege escalation.
Sigma
