Potential Arbitrary DLL Load Using Winword
Detects potential DLL sideloading using the Microsoft Office Winword process. This rule specifically looks for the execution of 'WINWORD.exe' with the command-line arguments '/l' and a '.dll' file, which is a known method for arbitrary DLL loading.
Sigma
