Windows Remote Image Load — Detection Rule
The following analytic detects image load events where a process loads a file from a remote share path. This activity is significant because remote DLL or image loading can be abused for execution, defense evasion, or lateral movement while leaving the payload hosted on another system. If confirmed malicious, an attacker may be loading code into a local process from attacker-controlled infrastructure.