Hijack Execution Flow: DLL Side-Loading

let imls = materialize(
    DeviceImageLoadEvents
| where InitiatingProcessIntegrityLevel in ("High", "System") and FileName !endswith ".exe"
| project FolderPath=tolower(FolderPath), InitiatingProcessFileName, InitiatingProcessIntegrityLevel
| distinct FolderPath, InitiatingProcessFileName, InitiatingProcessIntegrityLevel
);
imls
| join (
    DeviceFileEvents
| where FolderPath in~ ((imls
| project FolderPath)) and ActionType in ("FileCreated", "FileModified") and 
		InitiatingProcessIntegrityLevel !in ("High", "System", "") and InitiatingProcessAccountSid != "S-1-5-18" and 
		InitiatingProcessTokenElevation in ("TokenElevationTypeDefault", "TokenElevationTypeLimited") and InitiatingProcessAccountSid !endswith "-500"
| extend FolderPath=tolower(FolderPath)
) on FolderPath
| project-away FolderPath1