Executable Loaded an Unexpected DLL File (Side-Loading Alert)
Detects an executable loading an unexpected DLL, indicative of DLL side-loading used to execute a payload while evading static EDR signatures, as observed in CISA's red team engagement.
Microsoft Sentinel (KQL)
