Windows svchost.exe Loading newdev.dll from AppData Roaming (Potential Persistence)
Alerts on svchost.exe loading newdev.dll from AppData\Roaming, an unusual pattern consistent with stealthy persistence.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- image_load
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-02
- Updated
- 2026-07-31
What it detects
Flags an image load where svchost.exe loads a DLL named newdev.dll located under the user’s AppData\Roaming path. Loading a DLL from Roaming rather than a standard system directory can indicate stealthy persistence or malicious staging using a legitimate Windows process. The detection relies on Windows image load telemetry providing both the loading process path and the loaded DLL path.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-svchost-exe-loads-suspicious-dll-from-appdata-roaming-potential-persiste-1d7a57da
title: Windows svchost.exe Loading newdev.dll from AppData Roaming (Potential Persistence)
id: 4c849a39-1ef4-4342-9881-0ca5d7fae332
status: test
description: Flags an image load where svchost.exe loads a DLL named newdev.dll located under the user’s AppData\Roaming path. Loading a DLL from Roaming rather than a standard system directory can indicate stealthy persistence or malicious staging using a legitimate Windows process. The detection relies on Windows image load telemetry providing both the loading process path and the loaded DLL path.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/image_load_malware_coldsteel_persistence_service_dll.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-02
tags:
- attack.persistence
- detection.emerging-threats
- attack.stealth
logsource:
product: windows
category: image_load
detection:
selection:
Image|endswith: \svchost.exe
ImageLoaded|endswith: \AppData\Roaming\newdev.dll
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 1d7a57da-02e0-4f7f-92b1-c7b486ccfed5
type: derived