SparroWocky Trident Loader DLL Side-Loading

Ibrahim Saud@tektrix

•updated 23 days ago•0•0•3

This rule detects the presence or execution of known files 'winfsp-x64.dll' or 'DukeQt.dll' when located in suspicious, user-writable directories such as AppData, Temp, or ProgramData, while excluding standard system or program installation paths.