NightLedger DLL hijack: malicious SspiCli.dll loaded by AppVShNotify.exe
Detects the NightLedger DLL search-order hijacking technique where a malicious SspiCli.dll is loaded by the legitimate process AppVShNotify.exe. This rule triggers when SspiCli.dll is loaded from a directory other than the standard Windows System32 or SysWOW64 directories.
Microsoft Sentinel (KQL)
