Dragon Weave - RUSTCLOAK UnityPlayer DLL Sideloading
Identifies RuntimeBroker_update.exe sideloading the malicious Rust loader masquerading as UnityPlayer.dll. This detection specifically looks for the loading of 'UnityPlayer.dll' by 'RuntimeBroker_update.exe' in conjunction with the presence of a 'Com.dat' file, indicating the RUSTCLOAK malware's DLL sideloading technique.
Microsoft Sentinel (KQL)
