Windows: Creation of Non-Existent System DLLs in System32 Paths
Alerts when targeted non-existent system DLL filenames are created in Windows system directories, indicating potential DLL hijacking setup.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems), fornotes (SigmaHQ), DRL 1.1
- Published
- 2022-12-01
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file create events for specific DLL filenames under Windows system directories that are typically not present, such as within \Windows\System32 and selected subpaths. Creating these unusual DLLs may indicate staging for DLL search order hijacking or related phantom DLL techniques where attackers place malicious binaries using expected names. It relies on Windows file event telemetry capturing the created target filename and matching it to the defined set.
Reporting behind it
- remoteawesomethoughts.blogspot.comhttp://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
- clement.notin.orghttps://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/
- decoded.avast.iohttps://decoded.avast.io/martinchlumecky/png-steganography/
- github.comhttps://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc
- github.comhttps://github.com/Wh04m1001/SysmonEoP
- itm4n.github.iohttps://itm4n.github.io/cdpsvc-dll-hijacking/
- posts.specterops.iohttps://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
- securelist.comhttps://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/
- crowdstrike.comhttps://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/
- hexacorn.comhttps://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
- hexacorn.comhttps://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/
- hexacorn.comhttps://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/
- x.comhttps://x.com/0gtweet/status/1564131230941122561
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_create_non_existent_dlls.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-creation-non-existent-system-dlls-in-system32-df6ecb8b
title: "Windows: Creation of Non-Existent System DLLs in System32 Paths"
id: 53b9eab0-8d2a-416e-9599-6b49c3aa64b7
related:
- id: 6b98b92b-4f00-4f62-b4fe-4d1920215771
type: similar
- id: df6ecb8b-7822-4f4b-b412-08f524b4576c
type: derived
status: test
description: This rule flags file create events for specific DLL filenames under Windows system directories that are typically not present, such as within \Windows\System32 and selected subpaths. Creating these unusual DLLs may indicate staging for DLL search order hijacking or related phantom DLL techniques where attackers place malicious binaries using expected names. It relies on Windows file event telemetry capturing the created target filename and matching it to the defined set.
references:
- http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
- https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/
- https://decoded.avast.io/martinchlumecky/png-steganography/
- https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc
- https://github.com/Wh04m1001/SysmonEoP
- https://itm4n.github.io/cdpsvc-dll-hijacking/
- https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
- https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/
- https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/
- https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
- https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/
- https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/
- https://x.com/0gtweet/status/1564131230941122561
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_create_non_existent_dlls.yml
author: Nasreddine Bencherchali (Nextron Systems), fornotes, Huntrule Team
date: 2022-12-01
modified: 2026-01-24
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith:
- :\Windows\System32\axeonoffhelper.dll
- :\Windows\System32\cdpsgshims.dll
- :\Windows\System32\oci.dll
- :\Windows\System32\offdmpsvc.dll
- :\Windows\System32\shellchromeapi.dll
- :\Windows\System32\TSMSISrv.dll
- :\Windows\System32\TSVIPSrv.dll
- :\Windows\System32\wbem\wbemcomn.dll
- :\Windows\System32\WLBSCTRL.dll
- :\Windows\System32\wow64log.dll
- :\Windows\System32\WptsExtensions.dll
- \SprintCSP.dll
condition: selection
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_create_non_existent_dlls/info.yml
license: DRL-1.1