DLL search-order hijacking side-loading UNC1549 backdoor via Citrix/VMware/FortiGate/Microsoft binaries
Detects instances where legitimate, signed executables (specifically associated with Citrix, VMware, FortiGate, or Microsoft) load an unsigned DLL from the same directory as the executable. This pattern is indicative of DLL side-loading (Search-Order Hijacking), often used by attackers to gain persistence or mask malicious code execution under a trusted process. The rule excludes standard Windows System32/SysWOW64 directories to focus on non-standard, potentially attacker-controlled, file locations.
Splunk (SPL)
