NomadRAT sideload via renamed AV binary Acrobatlog.exe + scansts.dll
Detects the process 'Acrobatlog.exe' loading the DLL 'scansts.dll'. This pattern is frequently observed as a potential DLL side-loading or hijack attempt, where a non-standard or unexpected DLL is loaded by a specific process executable.
Microsoft Sentinel (KQL)
