Suspicious CRYPTBASE.dll File Creation
Detects the creation of CRYPTBASE.dll outside of the standard Windows system directories. This indicates an attacker staging the DLL for sideloading to exploit CWE-427 upon application execution.
Microsoft Sentinel (KQL)
