Bumblebee consent.exe DLL Side-Loading via msimg32.dll/version.dll

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•0

Detects DLL search-order hijacking by monitoring for the execution of 'consent.exe' from non-standard directories (e.g., user-writable paths like %TEMP% or %APPDATA%) alongside the loading of specific DLLs (msimg32.dll, version.dll) from that same non-standard directory, which is indicative of malicious side-loading activity observed in Bumblebee and Akira intrusion campaigns.