LegionLoader DLL Sideloading via 7z.dll or normaliz.dll in AppData\Roaming
This rule detects the loading of '7z.dll' or 'normaliz.dll' from locations outside of standard Windows system directories (System32, SysWOW64) or Program Files. It identifies instances where these DLLs are loaded from potentially suspicious paths, such as the user's AppData directory, or where the loaded module is unsigned or carries an invalid digital signature. This pattern is commonly indicative of binary masquerading or side-loading techniques.
Splunk (SPL)
