Mustang Panda DLL Sideloading via SolidPDFCreator or pcl2bmp Loading from Non-Standard Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the loading of specific DLL files (SolidPDFCreator.dll, ctxmui.dll) by suspicious or masquerading process names (pcl2bmp.exe, Project Proposal.exe, Memorandum of Understanding.exe) from common user-writable or temporary directories, which is often indicative of side-loading or execution of malicious components.