PUP Fangs - Sideloading via Bundled Vulnerable App

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•1

Detects the PUP installer dropping an outdated, legitimate application (e.g., old versions of VLC or Notepad++) alongside a malicious DLL to execute a sideloading attack. The rule identifies file creation events for DLLs followed by an image load event for an unsigned DLL within a short time frame, where the initiating process for the image load has a valid signature.