Detection Satelital DLL SideLoading via MFC — TURLA´S KAZUAR V3

This report presents a KQL analytic to detect MFC satellite DLL sideloading by tracking LOC.dll creation in user-writable paths (AppData, Temp, ProgramData, Public) by suspicious processes (wscript, cscript, mshta, powershell, cmd, certutil, installutil) and correlating subsequent DLL loads by executables with the same base name within five minutes. It joins DeviceFileEvents, DeviceImageLoadEvents, and DeviceProcessEvents to return loader command line, parent process, and integrity level for triage.