Potential DLL Sideloading Via VMware Xfer
Detects the loading of 'glib-2.0.dll' by the 'VMwareXferlogs.exe' utility from a directory other than the default VMware installation path. This behavior is indicative of potential DLL sideloading, where an attacker might place a malicious DLL in a non-standard location to be loaded by a legitimate application, often for privilege escalation, persistence, or defense evasion.
Sigma
