FlowCloud-style DLL sideloading followed by cloud-hosted C2 from same process
Detects a behavioral sequence where a signed process loads an unsigned DLL from a user-writable path (DLL sideloading) followed shortly by outbound HTTPS network connections from the same process to legitimate cloud storage or API infrastructure.
Microsoft Sentinel (KQL)
