Unsigned process loading opencv_world4120.dll for HVNC screen capture
Detects the loading of 'opencv_world4120.dll' by specific process names commonly associated with update activity (UpdateAssistant.exe, AppUpdateHelper.exe, SysMaintenance.exe) when the loaded DLL is either unsigned, untrusted, or has an invalid signature. This is indicative of potential DLL side-loading where malicious code is executed under the context of an ostensibly legitimate update process.
Microsoft Sentinel (KQL)
