Grandoreiro DLL Side-Loading via Known Malicious DLLs from User-Writable Paths
This rule detects the loading of specific DLL files (commonly associated with open-source software libraries like mingw or webp) from user-writable directories (Temp, Downloads, AppData, etc.) by specific processes. The rule further correlates these events with recent execution of potential phishing-related commands (WScript, CScript, or download-related activity) on the same host within a 1-hour window.
Splunk (SPL)
