Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths

Alerts when BaaUpdate.exe loads DLLs from Temp/Public-type locations associated with DLL search hijacking risk.

FreeReviewedSigma · High · v2

Product: windows
Category: image_load
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-10-18
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
- T1021.003Distributed Component Object Model
Collection
C2
Exfiltration
Impact

What it detects

This rule flags executions of baaupdate.exe that load DLL files from locations commonly writable by non-admin users, such as Temp, Public, and Default user directories. Loading DLLs from these paths can indicate COM hijacking or other DLL search-order abuse intended to execute attacker-controlled code in the context of the logged-on user. It relies on image load telemetry showing the loaded DLL path and the process image ending with BaaUpdate.exe.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Windows SpeechRuntime.exe Child Process Creation

Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes

Suspicious .NET LOLBin Execution via CasPol or RegAsm

Possible DarkGate DLL Sideloading via iTunesHelper Loading CoreFoundation

Suspicious extrac32 CAB Extraction Abuse

Malicious cdb.exe Masquerading as fontdrvhost in ProgramData (via process_creation)

Malicious certutil Decodehex Payload Reconstruction by DarkGate

Malicious MSIX Package Execution via App Installer ms-appinstaller Protocol (via process_creation)

Suspicious Child Process Spawned by Control Panel DCOM Surrogate

Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths

Pivot detection · T1218 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-baaupdate-exe-suspicious-dll-loads-from-publicly-writable-paths-6e8fe0a8

title: "Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths"
id: 250c74f1-4081-4887-bb0b-bb55c4de872a
related:
  - id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512
    type: similar
  - id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984
    type: derived
status: experimental
description: This rule flags executions of baaupdate.exe that load DLL files from locations commonly writable by non-admin users, such as Temp, Public, and Default user directories. Loading DLLs from these paths can indicate COM hijacking or other DLL search-order abuse intended to execute attacker-controlled code in the context of the logged-on user. It relies on image load telemetry showing the loaded DLL path and the process image ending with BaaUpdate.exe.
references:
  - https://github.com/rtecCyberSec/BitlockMove
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_susp_baaupdate_dll_load.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-18
tags:
  - attack.stealth
  - attack.t1218
  - attack.lateral-movement
  - attack.t1021.003
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \BaaUpdate.exe
    ImageLoaded|endswith: .dll
    ImageLoaded|contains:
      - :\Perflogs\
      - :\Users\Default\
      - :\Users\Public\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
      - \AppData\Roaming\
      - \Contacts\
      - \Favorites\
      - \Favourites\
      - \Links\
      - \Music\
      - \Pictures\
      - \ProgramData\
      - \Temporary Internet
      - \Videos\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL