GRAYRABBIT reflective loader invoked via core.dll CoreClientInstall export
Detects the loading or execution of 'core.dll' from non-standard system directories by common Windows proxy execution binaries (rundll32.exe, regsvr32.exe, cmd.exe, powershell.exe), which is a common indicator of DLL side-loading or malicious library hijacking.
Microsoft Sentinel (KQL)
