GUID-Named DLL Creation in Staging Paths

Tim Peck@timpeck

•updated Jan 5, 2026•13•1•108

Detects the creation of DLL files named with a GUID pattern in common staging directories. This technique was observed being used by the threat actor UKC-1230 to drop surrogate COM DLLs for persistence.