DLL side-loading (Vidar/wingo/HijackLoader) via trusted host binaries with rare parent-child pairing
Detects DLL side-loading attempts and suspicious process executions associated with the HijackLoader (wingo) malware distribution chain. The rule monitors for specific common applications loading known vulnerable DLLs from suspicious non-standard directories (e.g., ProgramData, Temp) and tracks rare parent-child process relationships associated with this campaign.
Splunk (SPL)
