APT24 BADAUDIO DLL Sideloading Persistence

Tim Peck@timpeck

•updated Nov 21, 2025•4•2•101

Detects a potential BADAUDIO DLL Sideloading persistence attempt, a technique used by APT24. The rule looks for the creation of a DLL, an executable, and a script/shortcut file (VBS, BAT, LNK) in a common user directory within a short time frame.