Windows Process Creation: SolidPDFCreator.dll Copy and Run Key Persistence Indicators
Flags Windows command lines that copy SolidPDFCreator.dll and set a Run registry key for auto-execution.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-15
- Updated
- 2026-07-31
What it detects
This rule identifies Windows command-line activity that copies a SolidPDFCreator.dll from a specific path and then writes a registry Run key entry containing “SolidPDF” and that same library path. Such behavior is consistent with initial staging and persistence mechanisms used during targeted intrusions. It relies on process creation telemetry with command-line fields to match the exact command fragments present in the observed execution chain.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-command-line-used-for-solidpdfcreator-dll-copy-and-run--7806bb49
title: "Windows Process Creation: SolidPDFCreator.dll Copy and Run Key Persistence Indicators"
id: 8411caf5-1ddd-4f54-8947-a5bb86222801
status: test
description: This rule identifies Windows command-line activity that copies a SolidPDFCreator.dll from a specific path and then writes a registry Run key entry containing “SolidPDF” and that same library path. Such behavior is consistent with initial staging and persistence mechanisms used during targeted intrusions. It relies on process creation telemetry with command-line fields to match the exact command fragments present in the observed execution chain.
references:
- https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Mustang-Panda-Australia-Campaign/proc_creation_win_apt_mustang_panda_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
tags:
- attack.execution
- attack.g0129
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_1:
CommandLine|contains|all:
- copy SolidPDFCreator.dll
- C:\Users\Public\Libraries\PhotoTvRHD\SolidPDFCreator.dll
selection_2:
CommandLine|contains|all:
- "reg "
- \Windows\CurrentVersion\Run
- SolidPDF
- C:\Users\Public\Libraries\PhotoTvRHD\
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 7806bb49-f653-48d3-a915-5115c1a85234
type: derived