Suspicious Dll Sideloading Via Pangphip
Detects potential DLL side-loading where the legitimate Palo Alto Networks executable 'PanGpHip.exe' is launched from a non-standard directory and loads 'libwaapi.dll' from the same path. This behavior is consistent with the technique described in the dmpdump report, where an LNK file executes the legitimate application to load a malicious DLL.
YARA-L
