Pay2Key DLL Sideloading via Malicious powrprof.dll Dropped in Avast Directory
Detects Pay2Key ransomware activity involving the extraction of suspicious DLLs into the Avast installation directory and the subsequent loading of these unsigned/unauthorized DLLs by legitimate Avast processes. This rule covers the file creation of known malicious DLL names, the use of 7za.exe for extraction into the directory, and the process module load events for unsigned DLLs within the Avast scope.
Microsoft Sentinel (KQL)
