Red Lamassu JFMBackdoor DLL Side-Loading: Signed Binary Loading Unsigned DLL < 24h
This rule detects scenarios where an application located in Program Files or Program Files (x86) loads an unsigned DLL from its own installation directory. It further correlates this activity by checking if the DLL was recently created (within 48 hours) to identify potentially suspicious new files, which may indicate DLL hijacking or side-loading attempts.
Splunk (SPL)
