Bumblebee Locale Kill-Switch: consent.exe Loading msimg32.dll from AppData Temp
This rule detects the suspicious loading of 'msimg32.dll' by 'consent.exe' from non-standard directories, specifically targeting temporary folders often used by the Bumblebee malware loader. This behavior is indicative of DLL side-loading to execute malicious code within the context of a legitimate system process.
Splunk (SPL)
