TELEPUZ NTDLL Unhooking via Fresh ntdll.dll Load from Disk by rundll32
Detects instances where rundll32.exe, likely used by the TELEPUZ threat actor, performs a direct file read of ntdll.dll from standard Windows system directories. This behavior is indicative of an attempt to obtain an unhooked copy of ntdll.dll to overwrite the in-memory, hooked version, thereby evading security monitoring.
Microsoft Sentinel (KQL)
