Operation DragonReturn DLL Sideloading via Mixed Reality.exe or wmplayer.exe
Detects instances where 'Mixed Reality.exe' or 'wmplayer.exe' load DLLs from suspicious directories such as AppData, Temp, or ProgramData, specifically when the loading process or the loaded DLL appears unsigned or lacks verification by Microsoft. This behavior is indicative of potential DLL sideloading or hijacking, where adversaries leverage trusted applications to execute malicious code.
Microsoft Sentinel (KQL)
