Dragon Weave - BrowserViewUtility Sideload Execution

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•9

This rule detects the sideloading of 'UnityPlayer.dll' by 'BrowserViewUtility.exe' in conjunction with network communication to a 'windows.net' domain. This activity is indicative of the 'Dragon Weave' campaign, specifically the 'RustCloak' malware, which uses DLL sideloading for execution and Azure cloud for C2.