DLL sideloading via signed Citrix pcl2bmp.exe loading ctxmui.dll
Detects instances where the executable 'pcl2bmp.exe' loads the DLL 'ctxmui.dll' from its own local directory. This behavior is indicative of potential DLL side-loading, where a legitimate application is used to load a malicious library by placing it in the same directory as the executable to influence the DLL search order.
Microsoft Sentinel (KQL)
