Mustang Panda Sideloaded DLL Loaded from Non Standard Path
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Mustang Panda sideloaded DLL SolidPDFCreator or ctxmui loaded outside Program Files
Severity
Trouble
Rule Requirement
Criteria
Action1:
actionname = "Image Loaded" AND ( OBJECTNAME contains "SolidPDFCreator.dll" OR OBJECTNAME contains "ctxmui.dll" ) AND OBJECTNAME notcontains "Program Files"
select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PRODUCT_NAME,Action1.OBJECTNAME,Action1.SIGNATURE,Action1.SIGNATURESTATUS
Detection
Execution Mode
continuous
Log Sources
Windows
