huntrule

Suspicious Service DLL Hijack of IKEEXT or PrintNotify

PremiumReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
HuntRule
Published
2026-09-14
Updated
2026-09-14
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects modification of the ServiceDll value for the IKEEXT or PrintNotify services, a DLL search-order and service hijack technique used by Winnti in Operation CuckooBees for persistence. Attackers point these built-in services at a malicious DLL so their code runs under a trusted service context. Tampering with the ServiceDll of these services is a strong persistence-and-evasion indicator.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange
Suspicious Impact of 'SMOKEDHAM Backdoor' with MSDTC Service Privilege Escalation via Command Line (via process_creation)
Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary
Service Hiding via SC Sdset Security Descriptor Modification
Suspicious msimg32.dll Loaded from Non-System Directory
DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL
Malicious Service DLL Hijack for Persistence via Lotus Blossom
Malicious TinyTurla ServiceDll Registration via svchost Group (via registry_set)
Suspicious ToyMaker LAGTOY Service Creation Masquerading as WmiPrvSV via sc.exe
Malicious Service Creation With Autostart binPath via sc.exe (via process_creation)
Suspicious Service DLL Hijack of IKEEXT or PrintNotify
Pivot detection · T1543.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.