huntrule

Windows Persistence via AppData Roaming newdev.dll File Creation

Detects creation of newdev.dll under a user’s AppData\Roaming directory for potential user-scoped persistence.

FreeUnreviewedSigmahighv1
title: Windows Persistence via AppData Roaming newdev.dll File Creation
id: 88df0364-dcaf-4578-be8c-254444dc175d
status: test
description: This rule flags creation of a DLL named newdev.dll in a user’s AppData\Roaming location. Attackers may use this pattern to establish persistence through a user-scoped component that can be loaded or executed later. Telemetry relies on Windows file creation events that include the full target filename path.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/file_event_win_malware_coldsteel_service_dll_creation.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-04-30
tags:
  - attack.persistence
  - detection.emerging-threats
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\Users\
    TargetFilename|endswith: \AppData\Roaming\newdev.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1fea93a2-1524-4a3c-9828-3aa0c2414e27
    type: derived

What it detects

This rule flags creation of a DLL named newdev.dll in a user’s AppData\Roaming location. Attackers may use this pattern to establish persistence through a user-scoped component that can be loaded or executed later. Telemetry relies on Windows file creation events that include the full target filename path.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.