Files With System DLL Name In Unsuspected Locations
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.). It is highly recommended to perform an initial baseline before using this rule in production.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "File Created or Modified" AND (FILENAME endswith "\secur32.dll,\tdh.dll" OR OBJECTNAME endswith "\secur32.dll,\tdh.dll") AND (FILENAME notcontains "C:\$WINDOWS.~BT\,C:\$WinREAgent\,C:\Windows\SoftwareDistribution\,C:\Windows\System32\,C:\Windows\SysWOW64\,C:\Windows\WinSxS\,C:\Windows\uus" AND OBJECTNAME notcontains "C:\$WINDOWS.~BT\,C:\$WinREAgent\,C:\Windows\SoftwareDistribution\,C:\Windows\System32\,C:\Windows\SysWOW64\,C:\Windows\WinSxS\,C:\Windows\uus") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.OBJECTNAME,Action1.FILENAME,Action1.PROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nasreddine Bencherchali (Nextron Systems)
