Backdoor.Mistic DLL Sideload via MpExtMs.exe Loading EndpointDlp.dll
This rule detects when the process 'MpExtMs.exe' loads the 'EndpointDlp.dll' library from a file path outside of the standard, expected directories (such as Windows Defender or System32 folders). This behavior is often indicative of potential DLL side-loading, where an attacker attempts to substitute a legitimate system DLL with a malicious version to execute code in the context of a trusted Microsoft process.
Microsoft Sentinel (KQL)
