Third Party Software DLL Sideloading Detection
This rule detects potential DLL sideloading attempts involving specific third-party software DLLs. It identifies when 'commfunc.dll' (associated with Lenovo software) or 'tosbtkbd.dll' (associated with Toshiba Bluetooth software) are loaded from unexpected or non-standard paths. The rule aims to catch instances where an attacker might place a malicious DLL with the same name in a location that a legitimate application will load before its intended, legitimate DLL, thereby achieving execution, persistence, privilege escalation, or defense evasion.
Sigma
