Proxy DLL sideload via version.dll loaded by signed OneDrive.exe with no Zone.Identifier
Detects DLL sideloading of 'version.dll' by a signed 'OneDrive.exe' process where the DLL was created via 'WriteFile' (indicating direct write rather than browser download) and lacks a 'Zone.Identifier' (Mark-of-the-Web). This combination is characteristic of evasion techniques found in toolkits like Dolphin X Agent Builder to bypass SmartScreen and initial execution defenses.
Microsoft Sentinel (KQL)
