Suspicious UIAutomationCore.dll Loading By Process
Detects when a process loads UIAutomationCore.dll, which may indicate abuse of Microsoft's UI Automation framework. This technique has been observed in Coyote malware for credential theft from banking applications and cryptocurrency exchanges. The rule monitors for processes that load the UI Automation Core library, which enables automated interaction with UI elements.
Sigma
