HijackLoader/CastleLoader DLL sideload via signed host executable
Detects instances where a legitimate, signed executable residing in a Program Files directory loads a DLL from a location other than standard Windows system directories. This behavior is indicative of DLL side-loading or DLL hijacking, techniques commonly used by loaders such as HijackLoader (IDAT Loader) and CastleLoader to execute malicious code within the context of a trusted process.
YARA-L
