Windows DLL Search Order Hijacking: Suspicious DLL Writes to App Dependency Folders
Alerts on suspicious .dll file creation by Office/cmd/scripting processes in AppData and OneDrive/Teams/Slack/VS Code directories.
- Product
- windows
- Category
- file_event
- Author
- Tim Rauch (rule), Elastic (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-10-21
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows file creation events where a process associated with Office and common script/download utilities writes a .dll into a Users\AppData directory under known application dependency locations (e.g., OneDrive, Teams, Slack, or VS Code). Writing a malicious DLL into such search paths can enable DLL search order hijacking when the target application loads modules. The detection relies on telemetry from Windows file events capturing the creating process image path and the target DLL filename and directory.
Reporting behind it
- github.comhttps://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc
- posts.specterops.iohttps://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows DLL Search Order Hijacking: Suspicious DLL Writes to App Dependency Folders"
id: 29f9d3d3-0f97-4a39-9ee3-bd07095e1b4e
status: test
description: This rule flags Windows file creation events where a process associated with Office and common script/download utilities writes a .dll into a Users\AppData directory under known application dependency locations (e.g., OneDrive, Teams, Slack, or VS Code). Writing a malicious DLL into such search paths can enable DLL search order hijacking when the target application loads modules. The detection relies on telemetry from Windows file events capturing the creating process image path and the target DLL filename and directory.
references:
- https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc
- https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml
author: Tim Rauch (rule), Elastic (idea), Huntrule Team
date: 2022-10-21
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1566
- attack.t1566.001
- attack.initial-access
- attack.t1574
- attack.t1574.001
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith:
- \winword.exe
- \excel.exe
- \powerpnt.exe
- \MSACCESS.EXE
- \MSPUB.EXE
- \fltldr.exe
- \cmd.exe
- \certutil.exe
- \mshta.exe
- \cscript.exe
- \wscript.exe
- \curl.exe
- \powershell.exe
- \pwsh.exe
TargetFilename|endswith: .dll
TargetFilename|contains|all:
- \Users\
- \AppData\
TargetFilename|contains:
- \Microsoft\OneDrive\
- \Microsoft OneDrive\
- \Microsoft\Teams\
- \Local\slack\app-
- \Local\Programs\Microsoft VS Code\
filter:
Image|endswith: \cmd.exe
TargetFilename|contains|all:
- \Users\
- \AppData\
- \Microsoft\OneDrive\
- \api-ms-win-core-
condition: selection and not filter
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
type: derived