ThinPrint Localisation DLL Sideloading from Windows Fonts
This rule detects the loading of 'tpsvcloc.dll' from the 'Windows\Fonts' directory by a process associated with ThinPrint. This behavior is indicative of DLL sideloading, where a malicious DLL is placed in a location that a legitimate application (ThinPrint in this case) will load, allowing for arbitrary code execution. The rule specifically looks for image load events where the module name is 'tpsvcloc.dll', the module path is within 'Windows\Fonts', and the actor process image path contains 'thinprint', 'tpsvc', or 'tp*.exe'.
Cortex XDR
