Lockbit Dll Sideloading Patterns
Detects potential DLL Sideloading activity as used by LockBit ransomware operators. This rule identifies when a legitimate, signed application (e.g., MpCmdRun.exe, jarsigner.exe) loads a corresponding DLL from the same, non-standard directory, a common TTP for defense evasion.
YARA-L
