Red Lamassu PlugX DLL Sideloading from Writable Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects DLL sideloading attempts associated with the Red Lamassu threat activity. The rule monitors for common Windows system binaries (odbcconf.exe, regsvr32.exe, rundll32.exe, and svchost.exe) loading DLL files from user-writable directories such as Temp, Downloads, AppData, and ProgramData, while filtering out legitimate loads from standard system paths.