Windows File Events: Suspicious .exe.local Path With comctl32.dll in System32
Detects System32 *.exe.local entries that reference comctl32.dll, consistent with DLL sideloading behavior.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems), Subhash P (@pbssubhash) (SigmaHQ), DRL 1.1
- Published
- 2022-12-16
- Updated
- 2026-07-31
What it detects
This rule flags file events where a target path under C:\Windows\System32 matches specific *.exe.local artifacts and ends with \comctl32.dll. Creating or placing DLLs under the System32 .exe.local mechanism can indicate an attempt to sideload a DLL and achieve privilege escalation or stealthy persistence. It relies on Windows file event telemetry capturing the full target filename for the created or modified file path.
Reporting behind it
- github.comhttps://github.com/binderlabs/DirCreate2System
- github.comhttps://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_system32_local_folder_privilege_escalation.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-flag-exe-local-dll-sideload-attempts-targeting-system32-comctl32-dll-07a99744
title: "Windows File Events: Suspicious .exe.local Path With comctl32.dll in System32"
id: 1e3cea34-01a6-4f0c-86c0-1a68286e2744
status: test
description: This rule flags file events where a target path under C:\Windows\System32 matches specific *.exe.local artifacts and ends with \comctl32.dll. Creating or placing DLLs under the System32 .exe.local mechanism can indicate an attempt to sideload a DLL and achieve privilege escalation or stealthy persistence. It relies on Windows file event telemetry capturing the full target filename for the created or modified file path.
references:
- https://github.com/binderlabs/DirCreate2System
- https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_system32_local_folder_privilege_escalation.yml
author: Nasreddine Bencherchali (Nextron Systems), Subhash P (@pbssubhash), Huntrule Team
date: 2022-12-16
modified: 2022-12-19
tags:
- attack.persistence
- attack.privilege-escalation
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|startswith:
- C:\Windows\System32\logonUI.exe.local
- C:\Windows\System32\werFault.exe.local
- C:\Windows\System32\consent.exe.local
- C:\Windows\System32\narrator.exe.local
- C:\Windows\System32\wermgr.exe.local
TargetFilename|endswith: \comctl32.dll
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 07a99744-56ac-40d2-97b7-2095967b0e03
type: derived