Query: write Sigma for Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDriv
Matching passage: Sigma rule: Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDriv. Logsource: windows / file_event. Rule: title: Potential Initial Access via DLL Search Order Hijacking id: dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c status: test description: Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking. references: - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc - https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0 author: Tim Rauch (rule), Elastic (idea) date: 2022-10-21 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1566 - attack.t1566.001 - attack.initial-access - attack.t1574 - attack.t1574.001 logsource: product: windows category: file_event detection: selection: Image|endswith: - \winword.exe - \excel.exe - \powerpnt.exe - \MSACCESS.EXE - \MSPUB.EXE - \fltldr.exe - \cmd.exe - \certutil.exe - \mshta.exe - \cscript.exe - \wscript.exe - \curl.exe - \powershell.exe - \pwsh.exe TargetFilename|endswith: .dll TargetFilename|contains|all: - \Users\ - \AppData\ TargetFilename|contains: - \Microsoft\OneDrive\ - \Microsoft OneDrive\ - \Microsoft\Teams\ - \Local\slack\app- - \Local\Programs\Microsoft VS Code\ filter: Image|endswith: \cmd.exe TargetFilename|contains|all: - \Users\ - \AppData\ - \Microsoft\OneDrive\ - \api-ms-win-core- condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects registry modifications related to 'OracleOciLib' and 'OracleOciLibPath' under 'MSDTC' settings. Threat actors ma. Logsource: windows / registry_set. Rule: title: Registry Modification for OCI DLL Redirection id: c0e0bdec-3e3d-47aa-9974-05539c999c89 status: experimental description: 'Detects registry modifications related to ''OracleOciLib'' and ''OracleOciLibPath'' under ''MSDTC'' settings. Threat actors may modify these registry keys to redirect the loading of ''oci.dll'' to a malicious DLL, facilitating phantom DLL hijacking via the MSDTC service. ' references: - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.defense-impairment - attack.t1112 - attack.t1574.001 logsource: category: registry_set product: windows detection: selection_ocilib: TargetObject|endswith: \SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLib filter_main_ocilib_file: Details|contains: oci.dll selection_ocilibpath: TargetObject|endswith: \SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLibPath filter_main_ocilibpath: Details|contains: '%SystemRoot%\System32\' condition: (selection_ocilib and not filter_main_ocilib_file) or (selection_ocilibpath and not filter_main_ocilibpath) falsepositives: - Unlikely level: high