Signed process side-loading unsigned/mismatched DLL from writable directory
Detects instances where a trusted process (defined by a signed executable) loads a DLL that is either unsigned, untrusted, or signed by a different entity than the parent process. This behavior is commonly associated with DLL hijacking or side-loading attacks originating from suspicious paths such as user profile directories, temporary folders, or public download areas.
Microsoft Sentinel (KQL)
