CookiETagRAT DLL sideload via Mp3tag.exe loading tak_deco_lib.dll
Detects instances where the Mp3tag executable (Mp3tag.exe) loads the DLL 'tak_deco_lib.dll'. This behavior is indicative of potential DLL sideloading or search order hijacking, where a malicious DLL is placed in the application's directory to be loaded by the legitimate process.
Microsoft Sentinel (KQL)
