OxiDLLRunner sideloading via googleupdate.exe outside Google Update path
Detects instances where googleupdate.exe is executed or loads DLLs from outside the legitimate Program Files paths, or correlates with v8_context_snapshot.bin file access within a 10-minute window, potentially indicating Google Update binary masquerading or side-loading.
Microsoft Sentinel (KQL)
