DLL sideloading of malicious wtsapi32.dll via ViPNet Update System itcsrvup64.exe
Detects the HelloNet campaign's persistence technique in which itcsrvup64.exe (ViPNet Update System, part of ViPNet Client) sideloads a malicious wtsapi32.dll from the ViPNet Update System directory to execute a payload at OS startup.
Microsoft Sentinel (KQL)
