PDF24 DLL Side-Loading of Cryptbase.dll
Detects the legitimate 'pdf24.exe' process loading 'cryptbase.dll' from a non-standard directory. This is indicative of a DLL side-loading attack, a technique used by the PDFSIDER malware to achieve execution and bypass security controls.
Microsoft Sentinel (KQL)
