Why “baselining” is the missing piece in DLL hijacking detections

This report provides a KQL-based hunting analytic to detect Windows DLL hijacking/side-loading by baselining normal DLL loads over 30 days and comparing them to a recent 1-hour window, highlighting deviations such as same-name-different-path shadowing, loads from user-writable locations, cross-directory abuse by trusted processes, same-directory side-loading, unsigned/unknown DLLs, and recently written DLLs, with a scoring model and reason set to aid SOC triage.