Query: Sigma rule for Detects creation of specific system DLL files that are usually not present on the system (or at least not in system dir
Matching passage: Sigma rule: Detects creation of specific system DLL files that are usually not present on the system (or at least not in system dir. Logsource: windows / file_event. Rule: title: Creation Of Non-Existent System DLL id: df6ecb8b-7822-4f4b-b412-08f524b4576c related: - id: 6b98b92b-4f00-4f62-b4fe-4d1920215771 type: similar status: test description: 'Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs. Thus, the creation of such DLLs may indicate preparation for phantom DLL hijacking attacks. ' references: - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/ - https://decoded.avast.io/martinchlumecky/png-steganography/ - https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc - https://github.com/Wh04m1001/SysmonEoP - https://itm4n.github.io/cdpsvc-dll-hijacking/ - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992 - https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/ - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/ - https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/ - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/ - https://x.com/0gtweet/status/1564131230941122561 author: Nasreddine Bencherchali (Nextron Systems), fornotes date: 2022-12-01 modified: 2026-01-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - :\Windows\System32\axeonoffhelper.dll - :\Windows\System32\cdpsgshims.dll - :\Windows\System32\oci.dll - :\Windows\System32\offdmpsvc.dll - :\Windows\System32\shellchromeapi.dll - :\Windows\System32\TSMSISrv.dll - :\Windows\System32\TSVIPSrv.dll - :\Windows\System32\wbem\wbemcomn.dll - :\Windows\System32\WLBSCTRL.dll - :\Windows\System32\wow64log.dll - :\Windows\System32\WptsExtensions.dll - \SprintCSP.dll condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/fil
Near-miss passage: Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1 id: 4a30ac0c-b9d6-4e01-b71a-5f851bbf4259 status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 😀 - 😃 - 😄 - 😁 - 😆 - 😅 - 😂 - 🤣 - 🥲 - 🥹 - ☺️ - 😊 - 😇 - 🙂 - 🙃 - 😉 - 😌 - 😍 - 🥰 - 😘 - 😗 - 😙 - 😚 - 😋 - 😛 - 😝 - 😜 - 🤪 - 🤨 - 🧐 - 🤓 - 😎 - 🥸 - 🤩 - 🥳 - 😏 - 😒 - 😞 - 😔 - 😟 - 😕 - 🙁 - ☹️ - 😣 - 😖 - 😫 - 😩 - 🥺 - 😢 - 😭 - 😮‍💨 - 😤 - 😠 - 😡 - 🤬 - 🤯 - 😳 - 🥵 - 🥶 - 😱 - 😨 - 😰 - 😥 - 😓 - 🫣 - 🤗 - 🫡 - 🤔 - 🫢 - 🤭 - 🤫 - 🤥 - 😶 - 😶‍🌫️ - 😐 - 😑 - 😬 - 🫠 - 🙄 - 😯 - 😦 - 😧 - 😮 - 😲 - 🥱 - 😴 - 🤤 - 😪 - 😵 - 😵‍💫 - 🫥 - 🤐 - 🥴 - 🤢 - 🤮 - 🤧 - 😷 - 🤒 - 🤕 - 🤑 - 🤠 - 😈 - 👿 - 👹 - 👺 - 🤡 - 💩 - 👻 - 💀 - ☠️ - 👽 - 👾 - 🤖 - 🎃 - 😺 - 😸 - 😹 - 😻 - 😼 - 😽 - 🙀 - 😿 - 😾 - 👋 - 🤚 - 🖐 - ✋ - 🖖 - 👌 - 🤌 - 🤏 - ✌️ - 🤞 - 🫰 - 🤟 - 🤘 - 🤙 - 🫵 - 🫱 - 🫲 - 🫳 - 🫴 - 👈 - 👉 - 👆 - 🖕 - 👇 - ☝️ - 👍 - 👎 - ✊ - 👊 - 🤛 - 🤜 - 👏 - 🫶 - 🙌 - 👐 - 🤲 - 🤝 - 🙏 - ✍️ - 💪 - 🦾 - 🦵 - 🦿 - 🦶 - 👣 - 👂 - 🦻 - 👃 - 🫀 - 🫁 - 🧠 - 🦷 - 🦴 - 👀 - 👁 - 👅 - 👄 - 🫦 - 💋 - 🩸 - 👶 - 👧 - 🧒 - 👦 - 👩 - 🧑 - 👨 - 👩‍🦱 - 🧑‍🦱 - 👨‍🦱 - 👩‍🦰 - 🧑‍🦰 - 👨‍🦰 - 👱‍♀️ - 👱 - 👱‍♂️ - 👩‍🦳 - 🧑‍🦳 - 👨‍🦳 - 👩‍🦲 - 🧑‍🦲 - 👨‍🦲 - 🧔‍♀️ - 🧔 - 🧔‍♂️ - 👵 - 🧓 - 👴 - 👲 - 👳‍♀️ - 👳 - 👳‍♂️ - 🧕 - 👮‍♀️ - 👮 - 👮‍♂️ - 👷‍♀️ - 👷 - 👷‍♂️ - 💂‍♀️ - 💂 - 💂‍♂️ - 🕵️‍♀️ - 🕵️ - 🕵️‍♂️ - 👩‍⚕️ - 🧑‍⚕️ - 👨‍⚕️ - 👩‍🌾 - 🧑‍🌾 - 👨‍🌾 - 👩‍🍳 - 🧑‍🍳 - 👨‍🍳 - 👩‍🎓 - 🧑‍🎓 - 👨‍🎓 - 👩‍🎤 - 🧑‍🎤 - 👨‍🎤 - 👩‍🏫 - 🧑‍🏫 - 👨‍🏫 - 👩‍🏭 - 🧑‍🏭 - 👨‍🏭 - 👩‍💻 - 🧑‍💻 - 👨‍💻 - 👩‍💼 - 🧑‍💼 - 👨‍💼 - 👩‍🔧 - 🧑‍🔧 - 👨‍🔧 - 👩‍🔬 - 🧑‍🔬 - 👨‍🔬 - 👩‍🎨 - 🧑‍🎨 - 👨‍🎨 - 👩‍🚒 - 🧑‍🚒 - 👨‍🚒 - 👩‍✈️ - 🧑‍✈️ - 👨‍✈️ - 👩‍🚀 - 🧑‍🚀 - 👨‍🚀 - 👩‍⚖️ - 🧑‍⚖️ - 👨‍⚖️ - 👰‍♀️ - 👰 - 👰‍♂️ - 🤵‍♀️ - 🤵 - 🤵‍♂️ - 👸 - 🫅 - 🤴 - 🥷 - 🦸‍♀️ - 🦸 - 🦸‍♂️ - 🦹‍♀️ - 🦹 - 🦹‍♂️ - 🤶 - 🧑‍🎄 - 🎅 - 🧙‍♀️ - 🧙 - 🧙‍♂️ - 🧝‍♀️ - 🧝 - 🧝‍♂️ - 🧛‍♀️ - 🧛 - 🧛‍♂️ - 🧟‍♀️ - 🧟 - 🧟‍♂️ - 🧞‍♀️ - 🧞 - 🧞‍♂️ - 🧜‍♀️ - 🧜 - 🧜‍♂️ - 🧚‍♀️ - 🧚 - 🧚‍♂️ - 🧌 - 👼 - 🤰 - 🫄 - 🫃 - 🤱 - 👩‍🍼 - 🧑‍🍼 - 👨‍🍼 - 🙇‍♀️ - 🙇 - 🙇‍♂️ - 💁‍♀️ - 💁 - 💁‍♂️ - 🙅‍♀️ - 🙅 - 🙅‍♂️ - 🙆‍♀️ - 🙆 - 🙆‍♂️ - 🙋‍♀️ - 🙋 - 🙋‍♂️ - 🧏‍♀️ - 🧏 - 🧏‍♂️ - 🤦‍♀️ - 🤦 - 🤦‍♂️ - 🤷‍♀️ - 🤷 - 🤷‍♂️ - 🙎‍♀️ - 🙎 - 🙎‍♂️ - 🙍‍♀️ - 🙍 - 🙍‍♂️ - 💇‍♀️ - 💇 - 💇‍♂️ - 💆‍♀️ - 💆 - 💆‍♂️ - 🧖‍♀️ - 🧖 - 🧖‍♂️ - 💅 - 💃 - 🕺 - 👯‍♀️ - 👯 - 👯‍♂️ - 🕴 - 👩‍🦽 - 🧑‍🦽 - 👨‍🦽 - 👩‍🦼 - 🧑‍🦼 - 👨‍🦼 - 🚶‍♀️ - 🚶 - 🚶‍♂️ - 👩‍🦯 - 🧑‍🦯 - 👨‍🦯 - 🧎‍♀️ - 🧎 - 🧎‍♂️ - 🏃‍♀️ - 🏃 - 🏃‍♂️ - 🧍‍♀️ - 🧍 - 🧍‍♂️ - 👭 - 🧑‍🤝‍🧑 - 👬 - 👫 - 👩‍❤️‍👩 - 💑 - 👨‍❤️‍👨 - 👩‍❤️‍👨 - 👩‍❤️‍💋‍👩 - 💏 - 👨‍❤️‍💋‍👨 - 👩‍❤️