huntrule

Windows File Creation of dllhost.exe in Public Documents for COLDSTEEL RAT Variants

Flags creation of C:\users\public\Documents\dllhost.exe on Windows, matching an indicator seen in some COLDSTEEL RAT variants.

FreeUnreviewedSigmahighv1
title: Windows File Creation of dllhost.exe in Public Documents for COLDSTEEL RAT Variants
id: 8dbe60b9-222c-49b3-b237-b980ee8458fe
status: test
description: Identifies creation of a file named dllhost.exe under C:\users\public\Documents\ on Windows. Attackers may place a renamed or masquerading executable in a publicly writable location to support execution and persistence while blending into expected filenames. The detection relies on file creation telemetry capturing the target filename and full path.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/file_event_win_malware_coldsteel_renamed_cmd.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-30
tags:
  - attack.persistence
  - detection.emerging-threats
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename: C:\users\public\Documents\dllhost.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c708a93f-46b4-4674-a5b8-54aa6219c5fa
    type: derived

What it detects

Identifies creation of a file named dllhost.exe under C:\users\public\Documents\ on Windows. Attackers may place a renamed or masquerading executable in a publicly writable location to support execution and persistence while blending into expected filenames. The detection relies on file creation telemetry capturing the target filename and full path.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.