All Detections

CRYPTBASE.dll Sideloading Anomaly

avatar
Ethan Andrews@eandrews
updated Jun 8, 2026104

Detects instances where CRYPTBASE.dll is loaded from a non-standard Windows directory, indicating potential DLL sideloading to deploy STX RAT.

Microsoft Sentinel (KQL)