Windows DLL Search Order Hijacking: Suspicious DLL Writes to App Dependency Folders

Alerts on suspicious .dll file creation by Office/cmd/scripting processes in AppData and OneDrive/Teams/Slack/VS Code directories.

FreeReviewedSigma · Medium · v2

Product: windows
Category: file_event
Author: Tim Rauch (rule), Elastic (idea) (SigmaHQ), DRL 1.1
Published: 2022-10-21
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Defense Evasion

Recon
Resource Dev
Initial Access
- T1566Phishing
- T1566.001Spearphishing Attachment
Execution
- T1574Hijack Execution Flow
- T1574.001DLL
Persistence
- T1574Hijack Execution Flow
- T1574.001DLL
Priv Esc
- T1574Hijack Execution Flow
- T1574.001DLL
Defense Evasion
- T1574Hijack Execution Flow
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows file creation events where a process associated with Office and common script/download utilities writes a .dll into a Users\AppData directory under known application dependency locations (e.g., OneDrive, Teams, Slack, or VS Code). Writing a malicious DLL into such search paths can enable DLL search order hijacking when the target application loads modules. The detection relies on telemetry from Windows file events capturing the creating process image path and the target DLL filename and directory.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

Suspicious Process Execution by Microsoft OneNote on Windows Child Programs

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Windows: Alert on Suspicious HH.EXE Process Execution

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)

Windows DLL Search Order Hijacking: Suspicious DLL Writes to App Dependency Folders

Pivot detection · T1574.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dll-search-order-hijacking-suspicious-dll-writes-to-appdata-onedrive-tea-dbbd9f66

title: "Windows DLL Search Order Hijacking: Suspicious DLL Writes to App Dependency Folders"
id: 29f9d3d3-0f97-4a39-9ee3-bd07095e1b4e
status: test
description: This rule flags Windows file creation events where a process associated with Office and common script/download utilities writes a .dll into a Users\AppData directory under known application dependency locations (e.g., OneDrive, Teams, Slack, or VS Code). Writing a malicious DLL into such search paths can enable DLL search order hijacking when the target application loads modules. The detection relies on telemetry from Windows file events capturing the creating process image path and the target DLL filename and directory.
references:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc
  - https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml
author: Tim Rauch (rule), Elastic (idea), Huntrule Team
date: 2022-10-21
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1566
  - attack.t1566.001
  - attack.initial-access
  - attack.t1574
  - attack.t1574.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \winword.exe
      - \excel.exe
      - \powerpnt.exe
      - \MSACCESS.EXE
      - \MSPUB.EXE
      - \fltldr.exe
      - \cmd.exe
      - \certutil.exe
      - \mshta.exe
      - \cscript.exe
      - \wscript.exe
      - \curl.exe
      - \powershell.exe
      - \pwsh.exe
    TargetFilename|endswith: .dll
    TargetFilename|contains|all:
      - \Users\
      - \AppData\
    TargetFilename|contains:
      - \Microsoft\OneDrive\
      - \Microsoft OneDrive\
      - \Microsoft\Teams\
      - \Local\slack\app-
      - \Local\Programs\Microsoft VS Code\
  filter:
    Image|endswith: \cmd.exe
    TargetFilename|contains|all:
      - \Users\
      - \AppData\
      - \Microsoft\OneDrive\
      - \api-ms-win-core-
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL