Game Updater Loads an Unsigned DLL from Its Own Directory
Detects a signed or expected game updater loading an unsigned DLL from the application directory, consistent with a compromised update package or side-loading chain. This rule specifically looks for image load events where the loaded module is a DLL, the module path is within common program directories (Games, Program Files, ProgramData), and the actor process is identified as a game, launcher, updater, or patch executable.
Cortex XDR
