T1574.002: WinLol Dropper Stages OneDrive.exe and version.dll Sideload in Temp

Tim Peck@timpeck

•updated 13 days ago•1•0•17

Detects the WinLol Rust dropper staging a DLL sideload by writing a copy of Microsoft OneDrive.exe and a proxy version.dll into a user temp directory by a non-OneDrive, non-installer process.