HijackLoader: Signed Process Loading DLL from User-Writable or Staging Path
Detects the loading of DLLs by signed processes from suspicious, user-writable, or known staging directories associated with malware loaders like HijackLoader. The rule monitors for module load events involving paths such as AppData, ProgramData, and user profile subdirectories, while excluding known legitimate publishers and paths.
SentinelOne
