SloppyLemming Sideloading via Renamed Microsoft Binaries
Detects the execution of legitimate Microsoft binaries, such as NGenTask.exe and phoneactivate.exe, from suspicious user-writable directories when the process has been renamed. This is a known TTP of the SloppyLemming threat actor for DLL sideloading.
Sigma
