JungleBamboo\UTA0560 DLL Side-Loading via wsc_updata.exe Loading wsc.dll from Temp
This rule detects instances where a process named 'wsc_updata.exe' executing from a Temp directory loads a library named 'wsc.dll'. This behavior is characteristic of DLL side-loading or DLL hijacking, where a malicious or potentially unwanted executable attempts to load a library from a user-writable directory to execute arbitrary code.
Microsoft Sentinel (KQL)
