Windows Cloud Files Filter Loaded by Uncommon Process — Detection Rule
The following analytic detects cldapi.dll being loaded by a process not associated with legitimate cloud sync activity. The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits.