SpiceRAT DLL sideload via Calibre ebook-edit.exe loading calibre-launcher.dll
Detects the loading of the 'calibre-launcher.dll' library by the 'ebook-edit.exe' process when accompanied by the creation of an 'edit2.hlp' file within a 10-minute window. This behavior pattern is indicative of potential side-loading or exploitation attempts where a legitimate process is coerced into interacting with a malicious or specifically placed helper file.
Microsoft Sentinel (KQL)
