Windows svchost.exe Loads Suspicious DLL from AppData Roaming (Potential Persistence)

Alerts on svchost.exe loading newdev.dll from AppData\Roaming, an unusual pattern consistent with stealthy persistence.

FreeUnreviewedSigmahighv1

windows-svchost-exe-loads-suspicious-dll-from-appdata-roaming-potential-persiste-1d7a57da

title: Windows svchost.exe Loads Suspicious DLL from AppData Roaming (Potential Persistence)
id: 4c849a39-1ef4-4342-9881-0ca5d7fae332
status: test
description: This rule flags a Windows image-load event where svchost.exe loads a DLL named newdev.dll from the user’s AppData\Roaming directory. Loading a DLL from non-standard locations under a system-hosted process can indicate persistence or stealthy execution by malware. The detection relies on process image load telemetry that includes the loading process path and the full loaded DLL path.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/image_load_malware_coldsteel_persistence_service_dll.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-02
tags:
  - attack.persistence
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: image_load
detection:
  selection:
    Image|endswith: \svchost.exe
    ImageLoaded|endswith: \AppData\Roaming\newdev.dll
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 1d7a57da-02e0-4f7f-92b1-c7b486ccfed5
    type: derived

What it detects

This rule flags a Windows image-load event where svchost.exe loads a DLL named newdev.dll from the user’s AppData\Roaming directory. Loading a DLL from non-standard locations under a system-hosted process can indicate persistence or stealthy execution by malware. The detection relies on process image load telemetry that includes the loading process path and the full loaded DLL path.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.