Fox Tempest - Sideloading via Signed Proxy (T1574.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Identifies a signed binary associated with Fox Tempest loading an unsigned, anomalous DLL from the same directory, specifically from common user-writable directories like Downloads, Temp, or AppData. This behavior is indicative of DLL side-loading for defense evasion or privilege escalation.