DLL Sideloading: Signed Process Loading Unsigned DLL from Writable Directory
Detects instances where a signed process loads a dynamic-link library (DLL) from a user-writable directory, such as Temp, AppData, Downloads, or Public. This behavior is a common technique used for DLL sideloading to hijack the execution flow of trusted, signed applications.
SentinelOne
