Fondue.exe DLL Side-Loading APPWIZ.cpl from Public Directory
Detects the legitimate Microsoft binary Fondue.exe loading APPWIZ.cpl from a non-standard public directory (C:\Users\Public\), indicating DLL side-loading, a technique observed in campaigns like Dropping Elephant.
Microsoft Sentinel (KQL)
