BumbleBee DLL Sideload: consent.exe Loading msimg32.dll from AppData Temp
Detects instances where the 'consent.exe' process (typically a Windows system utility) loads a DLL named 'msimg32.dll' from a user-writable Temp directory. This behavior is indicative of DLL search order hijacking or side-loading, where an attacker plants a malicious library in a directory that a process prioritizes during the search for dependencies.
Splunk (SPL)
