Sigma rule: Non-DLL Extension File Renamed With DLL Extension

Rule

Title

Non-DLL Extension File Renamed With DLL Extension

Status

test

Level

medium

Author

frack113

Date

2022-02-19

Modified

2023-11-11

File

rules-threat-hunting/windows/file/file_rename/file_rename_win_non_dll_to_dll_ext.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects rename operations of files with non-DLL extensions to files with a DLL extension. This is often performed by malware in order to avoid initial detections based on extensions.

Log source

product

windows

category

file_rename

definition

Requirements: Microsoft-Windows-Kernel-File Provider with at least the KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH keyword

Detection

selection:
    TargetFilename|endswith: '.dll'
filter_main_dll:
    # Note: To avoid file renames
    SourceFilename|endswith: '.dll'
filter_main_installers:
    SourceFilename|endswith: '.tmp'
filter_main_empty_source:
    SourceFilename: ''
filter_main_null_source:
    SourceFilename: null
filter_main_tiworker:
    Image|contains: ':\Windows\WinSxS\'
    Image|endswith: '\TiWorker.exe'
filter_main_upgrade:
    - Image|endswith: ':\Windows\System32\wuauclt.exe'
    - TargetFilename|contains: ':\$WINDOWS.~BT\Sources\'
filter_main_generic:
    Image|contains:
        - ':\Program Files (x86)\'
        - ':\Program Files\'
filter_optional_squirrel:
    SourceFilename|contains: '\SquirrelTemp\temp'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Likely from installers and temporary locations

Tags

• attack.stealth
• attack.t1036.008
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1036.008

References

• https://twitter.com/ffforward/status/1481672378639912960
• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036/T1036.md#atomic-test-1---system-file-copied-to-unusual-location

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/file/file_rename/file_rename_win_non_dll_to_dll_ext.yml