Potential DLL Sideloading via icardagt.exe or mfpmp.exe
This rule detects potential DLL sideloading attempts by monitoring the loading of specific DLLs (version.dll and rtworkq.dll) from non-standard Windows system directories. It specifically looks for these DLLs being loaded by 'icardagt.exe' or 'mfpmp.exe' processes outside of 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'. This behavior is indicative of an adversary attempting to execute malicious code by tricking legitimate applications into loading their malicious DLLs instead of the legitimate ones.
Microsoft Sentinel (KQL)
