T1574.002: SilkParasite DLL Sideloading via Signed Binaries (5 Malware Families)
Detects DLL sideloading across the SilkParasite campaign's five signed/trusted host binaries: MpDefenderCoreService.exe loading mpclient.dll (DriveSilkRAT), ebook-edit.exe loading calibre-launcher.dll (SpiceRAT), Mp3tag.exe loading tak_deco_lib.dll (CookiETagRAT), FineReader.exe loading dsp_ippv2_x64.dll (BloodAlchemy), and Acrobatlog.exe loading scansts.dll (NomadRAT).
Microsoft Sentinel (KQL)
