SparroWocky-style host masquerading: MUI resource load by non-System32 process

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•1

This rule detects a process loading English (.en-US) MUI resource files from the C:\Windows\System32\en-US\ directory when the initiating process is located outside of standard system directories (System32, SysWOW64, Program Files). This behavior is indicative of a masquerading or camouflage technique where a malicious executable attempts to mimic a legitimate system process by loading its localized resources.