DLL Sideloading from User-Writable Paths by Signed Executables
This rule detects potential DLL sideloading by identifying signed executables that load unsigned DLLs from user-writable directories, such as Temp, AppData, Downloads, or Documents. It excludes loads from standard, protected Windows directories to reduce noise.
SentinelOne
