MiniBrowse DLL Side-Loading via Legitimate Signed Executable in Non-Standard Directory
Detects the creation of DLL files in suspicious locations (AppData, Temp, ProgramData, Users\Public, Downloads) that are initiated by specific processes commonly associated with software that might be vulnerable to DLL side-loading, such as Microsoft, Citrix, VMware, or Fortinet binaries, when those processes are executing from outside standard protected directories.
CQL
