FILE-OTHER Go binary dll-load exploit attempt
This event is generated when a download of kernel32.dll is detected.
Attempted User Privilege Gain
Go binaries from before version 1.12.2 will run any arbitrary kernel32.dll, winmm.dll, and ws2_32.dll in the same directory path, possibly leading to remote code execution.
Ease of attack
- Cisco Talos Intelligence Group