Bandizip sideloading unsigned DLL from non-standard path after LNK execution
Detects when a Bandizip executable loads an unsigned dynamic-link library (DLL) from outside the standard installation directory, where the Bandizip process was launched by explorer.exe, potentially indicating DLL side-loading.
Microsoft Sentinel (KQL)
