Silver Fox DLL Sideload: COU_ITR lure spawning shells or loading nvdaHelperRemote.dll from user dirs
This rule detects potentially malicious activity involving the 'nvdaHelperRemote.dll' library and suspicious parent-child process relationships. It identifies instances where a process named 'COU_ITR' spawns suspicious children (cmd, powershell, rundll32), or where 'nvdaHelperRemote.dll' is loaded from non-standard or user-writable directories (such as AppData, Temp, Downloads, or Desktop), which is indicative of DLL hijacking or side-loading techniques.
Splunk (SPL)
