DLL Search Order Hijackig Via Additional Space in Path — Detection Rule

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

Read the full analysis on IntelFusions