TriBack Loader DLL Sideloading via Signed Host Binaries
Detects DLL sideloading of the TriBack Loader via three abused signed host binaries - Microsoft ServiceHub (hostfxr.dll), G DATA AVK (avk.dll), and Windows Defender MpCopyAccelerator (MpClient.dll) - each loading a malicious DLL of the same name from an unexpected, non-vendor location instead of the legitimate installation directory.
Microsoft Sentinel (KQL)
