All Detections

Qilin Attack Chain DLL Sideload to Driver Install

avatar
Georg Lauenstein@gsec
updated Apr 3, 202610115

Detects Qilin ransomware attack chain where DLL sideloading via msimg32.dll is followed by malicious driver installation on the same host

YARA-L