{"id":"13c02350-4177-4e45-ac17-cf7ca628ff5e","title":"Files With System DLL Name In Unsuspected Locations","description":"Detects the creation of a file with the \".dll\" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of \"System32\", \"SysWOW64\", etc.).\nIt is highly recommended to perform an initial baseline before using this rule in production.\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2024-06-24","modified":"","tags":["attack.stealth","attack.t1036.005"],"technique_ids":["T1036.005"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["Third party software might bundle specific versions of system DLLs."],"references":["Internal Research"],"source_path":"rules/windows/file/file_event/file_event_win_creation_system_dll_files.yml","source_sha256":"7a6e900e83d5dea3c42aa1912f02d78d03c1349304240157140dc0bf76a386e5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_creation_system_dll_files.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Files With System DLL Name In Unsuspected Locations\nid: 13c02350-4177-4e45-ac17-cf7ca628ff5e\nstatus: test\ndescription: |\n    Detects the creation of a file with the \".dll\" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of \"System32\", \"SysWOW64\", etc.).\n    It is highly recommended to perform an initial baseline before using this rule in production.\nreferences:\n    - Internal Research\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2024-06-24\ntags:\n    - attack.stealth\n    - attack.t1036.005\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        TargetFilename|endswith:\n            # Note: Add more System DLL that can be abused for DLL sideloading to increase coverage\n            - '\\secur32.dll'\n            - '\\tdh.dll'\n    filter_main_generic:\n        # Note: It is recommended to use a more robust filter instead of this generic one, to avoid false negatives.\n        TargetFilename|contains:\n            # - '\\SystemRoot\\System32\\'\n            - 'C:\\$WINDOWS.~BT\\'\n            - 'C:\\$WinREAgent\\'\n            - 'C:\\Windows\\SoftwareDistribution\\'\n            - 'C:\\Windows\\System32\\'\n            - 'C:\\Windows\\SysWOW64\\'\n            - 'C:\\Windows\\WinSxS\\'\n            - 'C:\\Windows\\uus\\'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Third party software might bundle specific versions of system DLLs.\n# Note: Upgrade to high after an initial baseline to your environement.\nlevel: medium\nregression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_creation_system_dll_files/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.005","id":"T1036.005","name":"Match Legitimate Resource Name or Location","page":"techniques/enterprise/T1036.005/"}],"data_path":"data/detection-rules/13c02350-4177-4e45-ac17-cf7ca628ff5e.json","kind":"sigma"}