Windows File Creation of dllhost.exe in Public Documents Used by COLDSTEEL RAT Variants
Flags creation of C:\users\public\Documents\dllhost.exe on Windows, matching an indicator seen in some COLDSTEEL RAT variants.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-30
- Updated
- 2026-07-31
What it detects
This rule flags the creation of a file named dllhost.exe specifically in C:\users\public\Documents\. Such masquerading into a common filename can help malware blend in with legitimate system processes and support persistence or execution staging. It relies on Windows file creation telemetry that records the target filename and full path for newly created files.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-creation-of-dllhost-exe-in-public-documents-for-coldsteel-rat-varia-c708a93f
title: Windows File Creation of dllhost.exe in Public Documents Used by COLDSTEEL RAT Variants
id: 8dbe60b9-222c-49b3-b237-b980ee8458fe
status: test
description: This rule flags the creation of a file named dllhost.exe specifically in C:\users\public\Documents\. Such masquerading into a common filename can help malware blend in with legitimate system processes and support persistence or execution staging. It relies on Windows file creation telemetry that records the target filename and full path for newly created files.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/file_event_win_malware_coldsteel_renamed_cmd.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-30
tags:
- attack.persistence
- detection.emerging-threats
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename: C:\users\public\Documents\dllhost.exe
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: c708a93f-46b4-4674-a5b8-54aa6219c5fa
type: derived