WinDirStat.exe sideloads malicious uxtheme.dll from ProgramData WinDir path
Detects the legitimate WinDirStat.exe binary loading a malicious uxtheme.dll from a non-standard directory (C:\ProgramData\WinDir\). This pattern is consistent with DLL side-loading techniques, specifically those associated with the SysAid update supply chain compromise.
Microsoft Sentinel (KQL)
