TELEPUZ ETW Patching via Known Payload DLL Paths in rundll32/svchost
Detects the loading of known TELEPUZ-specific DLLs into common Windows host processes (rundll32.exe and svchost.exe). TELEPUZ is known to perform ETW (Event Tracing for Windows) tampering by patching ntdll.dll functions during initialization, which is a technique used to suppress security telemetry.
Microsoft Sentinel (KQL)
