HijackLoader/CastleLoader DLL side-loading via signed host binaries (Opera, Radmin VPN, WizardDa42)
Detects DLL search-order hijacking where potentially malicious or unauthorized versions of common application DLLs (such as those from Opera or Qt5 framework) are loaded from non-standard locations like %TEMP%, %AppData%, or user-writable directories instead of their legitimate installation paths. This technique is often associated with loaders like HijackLoader/CastleLoader to execute arbitrary code within the context of a legitimate process.
Splunk (SPL)
