MLTBackdoor File Creation Detection

Kaung Khant Ko@kaungkhantko

•updated Jun 10, 2026•1•0•17

Detects the creation or modification of 'endpointdlp.dll' and 'data.bin' files on disk, which are key indicators of the MLTBackdoor infection chain prior to DLL sideloading. This rule focuses on the initial staging of these malicious components.