Suspicious Unsigned DLL Load by AV/EDR Remediation Process (Kaspersky/Defender)
Detects suspicious DLL loads or file drops performed by security product processes (avp.exe, MsMpEng.exe) from directories outside of standard, trusted vendor paths. It specifically flags unsigned or invalidly signed DLLs, which is indicative of DLL sideloading techniques used to abuse security software workflows for potential privilege escalation.
Microsoft Sentinel (KQL)
