Mirage Kitten NightLedger Backdoor: DLL Search-Order Hijack (SspiCli.dll via AppVShNotify.exe)
Detects NightLedger's delivery mechanism: the implant is compiled as a malicious SspiCli.dll and co-located with AppVShNotify.exe (a legitimate Microsoft App-V binary). AppVShNotify.exe imports RPCRT4.dll, which delay-loads SspiCli.dll when an authenticated RPC call is made; loading the implant from the working directory rather than System32. Any load of SspiCli.dll by AppVShNotify.exe from outside canonical Windows system paths is a binary-confidence indicator with near-zero false positive rate in production environments.
CQL
