Suspicious DismCore.dll File Creation
Detects the creation of a DLL named DismCore.dll within the ProgramData or AppData\Local\Microsoft\WindowsApps directories. This behavior is indicative of potential LucidPawn/LucidRook DLL sideloading preparation where it attempts to hijack the search order of legitimate DISM binaries.
Sigma
