Suspicious DLL Sideloading From ProgramData - ValleyRAT Pattern
Detects the DLL sideloading primitive used by the ValleyRAT (SilverFox APT) campaign documented by K7 Labs: a legitimate signed Windows binary executing from C:\ProgramData\ (typically C:\ProgramData\client\) that has been weaponized to sideload an attacker-controlled DLL. The K7 analysis documents GameBox.exe (Tencent) as the carrier in this campaign, but ValleyRAT operators rotate sideloading carriers across campaigns - AntiyAVL.exe, DXVZ.exe, DXOPT.exe, VPNclient.exe, and various Chinese-language application binaries have all been observed as carriers. The stable detection target is the technique: any binary executing from ProgramData OR utility.dll being loaded from ProgramData.
Sigma
