DLL sideloading via renamed Sangfor exe (defender.exe/Sang.exe) loading libngs.dll outside install path or signer mismatch
Detects DLL sideloading where a renamed Sangfor executable (defender.exe/Sang.exe) loads libngs.dll/libsrapc.dll outside the legitimate install path or with a signer mismatch.
Microsoft Sentinel (KQL)
