BLOODALCHEMY sideloading graphics-hook-filter64.dll via renamed svchost.exe
Detects instances where svchost.exe runs outside the standard System32 or SysWOW64 directories and loads the graphics-hook-filter64.dll library, or where the known hash of this sideloaded payload is observed. This behavior is correlated with the presence of the encrypted configuration file graphics-hook_config.bin on the same device.
Microsoft Sentinel (KQL)
