Threat Hunt: DLL Side-Loading with Process Masquerading and MOTW
This rule detects suspicious activity involving the writing of both DLL and EXE files to the same path, followed by process masquerading (where the file name differs from the original file name) and subsequent DLL side-loading. It also attempts to identify the source URL if the Mark-of-the-Web (MOTW) is present, indicating a downloaded file. The detection chain tracks the process that writes the files, the parent process that initiates the file write, the process that performs the DLL side-load, and finally the loaded DLLs themselves, including various module load telemetry classifications.
CQL
