APT37 DLL Side-Loading via Sysinternals Utilities
Detects a specific DLL side-loading pattern used by APT37 in the "Operation Artemis" campaign. A legitimate Sysinternals utility (e.g., 'mhelp.exe', 'vhelp.exe', 'Volumeid1.exe') is dropped into the %TEMP% directory along with a malicious 'version.dll'. The legitimate process is then executed, causing it to load the malicious DLL.
Sigma
