Steganographic MaaS Loader Chain: Optimax.dll and System Optimizer Ultimate.dll In-Memory Load
Detects the in-memory loading of 'Optimax.dll' and 'System Optimizer Ultimate.dll', which are identified as first and second-stage loaders respectively, associated with a steganographic Malware-as-a-Service (MaaS) delivery chain. This chain is known to drop Remcos RAT and other malware families. The rule also identifies related dropper processes based on internal file names 'TuglaInsaatci' and 'oacY.exe', and suspicious API calls indicative of process injection techniques like CreateRemoteThread and ProcessHollowing.
Microsoft Sentinel (KQL)
