Sigma rule: Files With System DLL Name In Unsuspected Locations

Rule

Title

Files With System DLL Name In Unsuspected Locations

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2024-06-24

File

rules/windows/file/file_event/file_event_win_creation_system_dll_files.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.).
It is highly recommended to perform an initial baseline before using this rule in production.

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|endswith:
        # Note: Add more System DLL that can be abused for DLL sideloading to increase coverage
        - '\secur32.dll'
        - '\tdh.dll'
filter_main_generic:
    # Note: It is recommended to use a more robust filter instead of this generic one, to avoid false negatives.
    TargetFilename|contains:
        # - '\SystemRoot\System32\'
        - 'C:\$WINDOWS.~BT\'
        - 'C:\$WinREAgent\'
        - 'C:\Windows\SoftwareDistribution\'
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\WinSxS\'
        - 'C:\Windows\uus\'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Third party software might bundle specific versions of system DLLs.

Tags

• attack.stealth
• attack.t1036.005

MITRE ATT&CK ids this rule names

• T1036.005

References

• Internal Research

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_creation_system_dll_files.yml