Screening Serpens - MiniJunk V2 Sideloading Sequence
This rule detects a specific DLL sideloading sequence associated with the 'Screening Serpens' threat actor. It correlates the loading of 'uevmonitor.dll' with the subsequent dropping of 'unbcl.dll' by the same initiating process within a 5-minute window. This behavior is indicative of the MiniJunk V2 malware's execution chain, where 'uevmonitor.dll' is likely the legitimate application being hijacked to load the malicious 'unbcl.dll'.
Microsoft Sentinel (KQL)
