Files With System DLL Name In Unsuspected Locations

Title: Files With System DLL Name In Unsuspected Locations
Status: test
Description:Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.). It is highly recommended to perform an initial baseline before using this rule in production.
References:
  -Internal Research
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-06-24
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1036.005'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    TargetFilename|endswith:
      -'\secur32.dll'
      -'\tdh.dll'

  filter_main_generic:
    TargetFilename|contains:
      -'C:\$WINDOWS.~BT\'
      -'C:\$WinREAgent\'
      -'C:\Windows\SoftwareDistribution\'
      -'C:\Windows\System32\'
      -'C:\Windows\SysWOW64\'
      -'C:\Windows\WinSxS\'
      -'C:\Windows\uus\'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Third party software might bundle specific versions of system DLLs.
Level: medium