Camera Management Software - DLL Dropped in Vendor Install Directory
Detects creation of a DLL inside a camera management software installation directory under Program Files. The campaign dropped malicious DLLs alongside the trusted vendor binary so that the signed camera client side-loads them at startup, proxying execution through a legitimate vendor process (T1574.002 / T1036.005).
YARA-L
