Setup.exe sideloading winmm.dll from user-writable folder (YobaDropper)
Detects instances where Setup.exe loads the winmm.dll module from the same non-system directory located in user-writable paths (such as Users, Downloads, AppData, Temp, or ProgramData), which is indicative of DLL hijacking or side-loading activity.
Microsoft Sentinel (KQL)
