DragonForce GlobalTellurSync javaw.exe sideloads jli.dll from non-standard path

Arnold Chan@slaz

•updated 3 days ago•1•0•1

This rule detects instances of 'javaw.exe' executing from unusual directories (e.g., AppData, Temp, Users\Public) while loading a 'jli.dll' file from a related non-standard path, or simultaneously being associated with a scheduled task execution involving 'GlobalTellurSync'. This behavior is indicative of potential DLL side-loading or a persistence mechanism where a legitimate Java executable is repurposed to run malicious code.