BumbleBee DLL Sideload via Trojanized MSI — consent.exe Loading msimg32.dll from Temp
Detects a multi-stage activity chain associated with BumbleBee malware. The rule correlates the execution of an MSI installer from user-writable directories (e.g., Downloads, Temp) with the creation of a 'msimg32.dll' file in a non-System32 directory, followed by the loading of this suspicious DLL into the 'consent.exe' process. This pattern is characteristic of BumbleBee's DLL sideloading execution technique.
Microsoft Sentinel (KQL)
