Windows baaupdate.exe Suspicious DLL Loads from Publicly Writable Paths

title: Windows baaupdate.exe Suspicious DLL Loads from Publicly Writable Paths
id: 250c74f1-4081-4887-bb0b-bb55c4de872a
related:
  - id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512
    type: similar
  - id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984
    type: derived
status: experimental
description: This rule flags instances where BaaUpdate.exe loads a DLL whose path ends in .dll and matches common publicly writable locations (e.g., Temp, Public, Users Default). Attackers may abuse this behavior to load malicious libraries in place of legitimate DLLs, potentially enabling code execution during the utility’s operation. The detection relies on image load telemetry that records the loading process image name and the full path of the DLL being loaded.
references:
  - https://github.com/rtecCyberSec/BitlockMove
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_susp_baaupdate_dll_load.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-18
tags:
  - attack.stealth
  - attack.t1218
  - attack.lateral-movement
  - attack.t1021.003
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \BaaUpdate.exe
    ImageLoaded|endswith: .dll
    ImageLoaded|contains:
      - :\Perflogs\
      - :\Users\Default\
      - :\Users\Public\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
      - \AppData\Roaming\
      - \Contacts\
      - \Favorites\
      - \Favourites\
      - \Links\
      - \Music\
      - \Pictures\
      - \ProgramData\
      - \Temporary Internet
      - \Videos\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1