{"id":"df6ecb8b-7822-4f4b-b412-08f524b4576c","title":"Creation Of Non-Existent System DLL","description":"Detects creation of specific system DLL files that are  usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes.\nPhantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.\nThus, the creation of such DLLs may indicate preparation for phantom DLL hijacking attacks.\n","author":"Nasreddine Bencherchali (Nextron Systems), fornotes","status":"test","level":"medium","date":"2022-12-01","modified":"2026-01-24","tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.001"],"technique_ids":["T1574.001"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unknown"],"references":["http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html","https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/","https://decoded.avast.io/martinchlumecky/png-steganography/","https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc","https://github.com/Wh04m1001/SysmonEoP","https://itm4n.github.io/cdpsvc-dll-hijacking/","https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992","https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/","https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/","https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/","https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/","https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/","https://x.com/0gtweet/status/1564131230941122561"],"source_path":"rules/windows/file/file_event/file_event_win_create_non_existent_dlls.yml","source_sha256":"6bc6d5e5055ec3d520e60cf4b3017339ec2766336d7198f67347385abc8e3aa9","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_create_non_existent_dlls.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Creation Of Non-Existent System DLL\nid: df6ecb8b-7822-4f4b-b412-08f524b4576c\nrelated:\n    - id: 6b98b92b-4f00-4f62-b4fe-4d1920215771 # ImageLoad rule\n      type: similar\nstatus: test\ndescription: |\n    Detects creation of specific system DLL files that are  usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes.\n    Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.\n    Thus, the creation of such DLLs may indicate preparation for phantom DLL hijacking attacks.\nreferences:\n    - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html\n    - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/\n    - https://decoded.avast.io/martinchlumecky/png-steganography/\n    - https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc\n    - https://github.com/Wh04m1001/SysmonEoP\n    - https://itm4n.github.io/cdpsvc-dll-hijacking/\n    - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992\n    - https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/\n    - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/\n    - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/\n    - https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/\n    - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/\n    - https://x.com/0gtweet/status/1564131230941122561\nauthor: Nasreddine Bencherchali (Nextron Systems), fornotes\ndate: 2022-12-01\nmodified: 2026-01-24\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.001\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|endswith:\n            - ':\\Windows\\System32\\axeonoffhelper.dll'\n            - ':\\Windows\\System32\\cdpsgshims.dll'\n            - ':\\Windows\\System32\\oci.dll'\n            - ':\\Windows\\System32\\offdmpsvc.dll'\n            - ':\\Windows\\System32\\shellchromeapi.dll'\n            - ':\\Windows\\System32\\TSMSISrv.dll'\n            - ':\\Windows\\System32\\TSVIPSrv.dll'\n            - ':\\Windows\\System32\\wbem\\wbemcomn.dll'\n            - ':\\Windows\\System32\\WLBSCTRL.dll'\n            - ':\\Windows\\System32\\wow64log.dll'\n            - ':\\Windows\\System32\\WptsExtensions.dll'\n            - '\\SprintCSP.dll'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\nregression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_create_non_existent_dlls/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/df6ecb8b-7822-4f4b-b412-08f524b4576c.json","kind":"sigma"}