MSI-Installed App in User-Writable Path Sideloading Unsigned DLL from App Dir
Detects a process launched by msiexec.exe or WixShellExec from a user-writable install path (%LOCALAPPDATA%\Programs) that subsequently loads an unsigned DLL from its own application directory within a short time window.
YARA-L
