ZiChatBot Shellcode Searches for the Policy.dllcppage Marker

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•2

Detects a loader command or memory-scanning utility referencing the Policy.dllcppage.dll marker that ZiChatBot replaces with its terminate.dll path. This rule specifically looks for process command lines containing both 'Policy.dllcppage.dll' and 'terminate.dll' executed by processes with filenames like python, rundll32, vcpktsvr, or loader.