Query: detect Detects creation of specific system DLL files that are usually not present on the system (or at least not in system dir in logs
Matching passage: Sigma rule: Detects creation of specific system DLL files that are usually not present on the system (or at least not in system dir. Logsource: windows / file_event. Rule: title: Creation Of Non-Existent System DLL id: df6ecb8b-7822-4f4b-b412-08f524b4576c related: - id: 6b98b92b-4f00-4f62-b4fe-4d1920215771 type: similar status: test description: 'Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs. Thus, the creation of such DLLs may indicate preparation for phantom DLL hijacking attacks. ' references: - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/ - https://decoded.avast.io/martinchlumecky/png-steganography/ - https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc - https://github.com/Wh04m1001/SysmonEoP - https://itm4n.github.io/cdpsvc-dll-hijacking/ - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992 - https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/ - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/ - https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/ - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/ - https://x.com/0gtweet/status/1564131230941122561 author: Nasreddine Bencherchali (Nextron Systems), fornotes date: 2022-12-01 modified: 2026-01-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - :\Windows\System32\axeonoffhelper.dll - :\Windows\System32\cdpsgshims.dll - :\Windows\System32\oci.dll - :\Windows\System32\offdmpsvc.dll - :\Windows\System32\shellchromeapi.dll - :\Windows\System32\TSMSISrv.dll - :\Windows\System32\TSVIPSrv.dll - :\Windows\System32\wbem\wbemcomn.dll - :\Windows\System32\WLBSCTRL.dll - :\Windows\System32\wow64log.dll - :\Windows\System32\WptsExtensions.dll - \SprintCSP.dll condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/fil
Near-miss passage: Sigma rule: Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and. Logsource: windows / process_creation. Rule: title: Renamed MegaSync Execution id: 643bdcac-8b82-49f4-9fd9-25a90b929f3b status: test description: Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti. references: - https://redcanary.com/blog/rclone-mega-extortion/ author: Sittikorn S date: 2021-06-22 modified: 2023-02-03 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: selection: OriginalFileName: megasync.exe filter: Image|endswith: \megasync.exe condition: selection and not filter falsepositives: - Software that illegally integrates MegaSync in a renamed form - Administrators that have renamed MegaSync level: high