Suspicious Libcurl.dll Side-Loading
Detects the loading of 'libcurl.dll' from suspicious or temporary directories such as ProgramData, Users\Public, or Temp. This behavior is associated with DLL side-loading techniques, such as those used by the BRUSHLOGGER keylogger which masquerades as 'libcurl.dll' to execute malicious code and capture keystrokes.
Sigma
