Mustang Panda PlugX DLL Sideloading - Signed EXE Loading DLL from Suspicious User Path
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
Microsoft Sentinel (KQL)
