OnyxC2 DLL Sideloading
This rule detects potential DLL sideloading activity by monitoring process creation events where specific executables ("Setup_File_75.593.2113.exe" or "SystemSettings.exe") are launched with a command line containing "borlndmm.dll". It then correlates this with file events to confirm the presence of "borlndmm.dll" on the same device. This pattern is indicative of the OnyxC2 malware attempting to load a malicious DLL.
Microsoft Sentinel (KQL)
