Possible Vcruntime140 DLL Sideloading (via image_load)

This rule detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library. Threat actors have been observed using DLL sideloading methods to load hostile payloads under the guise of legitimate applications such as SqlWriter, SqlDumper etc. Notably, APT29 has been documented abusing WinELOADER to sideload vcruntime140.dll for running hostile code.