Windows: Detect newdev.dll created in AppData\Roaming\ starting from C:\Users\
Detects creation of newdev.dll under a user’s AppData\Roaming directory for potential user-scoped persistence.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- file_event
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-30
- Updated
- 2026-07-31
What it detects
This rule identifies creation of a file named newdev.dll located under AppData\Roaming\newdev.dll for paths starting with C:\Users\. Creating or staging DLLs in user roaming profiles is a common persistence technique because it can survive user sessions and execute in user context. It relies on file creation telemetry (file path and filename) from Windows file event logging.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-persistence-via-appdata-roaming-newdev-dll-file-creation-1fea93a2
title: "Windows: Detect newdev.dll created in AppData\\Roaming\\ starting from C:\\Users\\"
id: 88df0364-dcaf-4578-be8c-254444dc175d
status: test
description: This rule identifies creation of a file named newdev.dll located under AppData\Roaming\newdev.dll for paths starting with C:\Users\. Creating or staging DLLs in user roaming profiles is a common persistence technique because it can survive user sessions and execute in user context. It relies on file creation telemetry (file path and filename) from Windows file event logging.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/file_event_win_malware_coldsteel_service_dll_creation.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-04-30
tags:
- attack.persistence
- detection.emerging-threats
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|startswith: C:\Users\
TargetFilename|endswith: \AppData\Roaming\newdev.dll
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 1fea93a2-1524-4a3c-9828-3aa0c2414e27
type: derived