TriBack Loader Shellcode Execution via Uncommon Win32 Callback APIs
Detects TriBack Loader variants executing decrypted shellcode through rarely-monitored Win32 callback APIs (InitOnceExecuteOnce, CreateTimerQueueTimer, or dynamically-resolved EtwpCreateEtwThread) instead of the commonly-hooked CreateThread/VirtualAlloc-execute pattern, evading EDR thread-creation hooks after DLL sideloading. InitOnceExecuteOnce and CreateTimerQueueTimer calls only trigger when the same process has also loaded an unsigned DLL via LoadLibrary, correlating the callback-based execution primitive with the DLL-sideloading stage of the TriBack chain and reducing alerts on benign standalone use of these synchronization/timer APIs.
Microsoft Sentinel (KQL)
