Windows file creation: System DLL names in uncommon directories

Alerts on creation of .dll files named like system DLLs in unexpected Windows directories.

FreeUnreviewedSigmamediumv1

windows-file-creation-system-dll-names-in-uncommon-directories-13c02350

title: "Windows file creation: System DLL names in uncommon directories"
id: d26241cf-b5af-4638-b6db-269d425a97f6
status: test
description: This rule flags Windows file creation events where a newly created file ends with .dll and the filename includes names of common system DLLs in locations outside typical system paths. Attackers may place or masquerade DLLs in unusual directories to enable stealthy DLL loading or side-loading attempts. It relies on file event telemetry with the created file path (TargetFilename) to match specific system DLL names while excluding common baseline directories such as System32, SysWOW64, and several Windows update/recovery locations.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_creation_system_dll_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-24
tags:
  - attack.stealth
  - attack.t1036.005
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - \secur32.dll
      - \tdh.dll
  filter_main_generic:
    TargetFilename|contains:
      - C:\$WINDOWS.~BT\
      - C:\$WinREAgent\
      - C:\Windows\SoftwareDistribution\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
      - C:\Windows\uus\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Third party software might bundle specific versions of system DLLs.
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_creation_system_dll_files/info.yml
license: DRL-1.1
related:
  - id: 13c02350-4177-4e45-ac17-cf7ca628ff5e
    type: derived

What it detects

This rule flags Windows file creation events where a newly created file ends with .dll and the filename includes names of common system DLLs in locations outside typical system paths. Attackers may place or masquerade DLLs in unusual directories to enable stealthy DLL loading or side-loading attempts. It relies on file event telemetry with the created file path (TargetFilename) to match specific system DLL names while excluding common baseline directories such as System32, SysWOW64, and several Windows update/recovery locations.

Known false positives

Third party software might bundle specific versions of system DLLs.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.