Mustang Panda ZOHOMURK DLL Sideloading via pcl2bmp.exe and ctxmui.dll
Detects DLL sideloading behavior where the legitimate Citrix Receiver executable 'pcl2bmp.exe' loads the malicious library 'ctxmui.dll' from common staging directories like 'C:\Users\Public\Documents\' or 'C:\ProgramData\Citrix\'. This activity is characteristic of the ZOHOMURK implant deployment attributed to Mustang Panda.
Microsoft Sentinel (KQL)
