Sigma rule: Potential Initial Access via DLL Search Order Hijacking

Rule

Title

Potential Initial Access via DLL Search Order Hijacking

Status

test

Level

medium

Author

Tim Rauch (rule), Elastic (idea)

Date

2022-10-21

File

rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Log source

product

windows

category

file_event

Detection

selection:
    Image|endswith:
        # add more processes when you find them
        - '\winword.exe'
        - '\excel.exe'
        - '\powerpnt.exe'
        - '\MSACCESS.EXE'
        - '\MSPUB.EXE'
        - '\fltldr.exe'
        - '\cmd.exe'
        - '\certutil.exe'
        - '\mshta.exe'
        - '\cscript.exe'
        - '\wscript.exe'
        - '\curl.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
    TargetFilename|endswith: '.dll'
    TargetFilename|contains|all:
        - '\Users\'
        - '\AppData\'
    TargetFilename|contains:
        # add more suspicious paths when you find them
        - '\Microsoft\OneDrive\'
        - '\Microsoft OneDrive\'
        - '\Microsoft\Teams\'
        - '\Local\slack\app-'
        - '\Local\Programs\Microsoft VS Code\'
filter:
    Image|endswith: '\cmd.exe'
    TargetFilename|contains|all:
        - '\Users\'
        - '\AppData\'
        - '\Microsoft\OneDrive\'
        - '\api-ms-win-core-'
condition: selection and not filter

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.persistence
• attack.execution
• attack.stealth
• attack.t1566
• attack.t1566.001
• attack.initial-access
• attack.t1574
• attack.t1574.001

MITRE ATT&CK ids this rule names

• T1566
• T1566.001
• T1574
• T1574.001

References

• https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc
• https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml