DriveSilkRAT DLL Sideload via MpDefenderCoreService.exe
This rule detects scenarios where the 'MpDefenderCoreService.exe' process or a process attempting to masquerade as it loads 'mpclient.dll' from a directory path outside of the standard Windows Defender installation folders. This behavior is highly indicative of an adversary masquerading as a legitimate Windows Defender service or attempting to hijack a security-related process to evade detection.
Microsoft Sentinel (KQL)
