BumbleBee DLL Sideloading via consent.exe or icardagt.exe from Non-Standard Path

Georgios Maragos@Gmarak

•updated Jul 1, 2026•7•0•21

Detects DLL search order hijacking of legitimate Windows binaries consent.exe or icardagt.exe. The rule triggers when these binaries are executed from non-standard, user-writable directories (e.g., %TEMP%, %APPDATA%), which is a common technique used by the BumbleBee malware loader to sideload a malicious msimg32.dll.