System DLL Name in Unsuspected Locations
This rule detects the creation of files with a '.dll' extension that have names matching known Windows system DLLs (e.g., 'secur32.dll', 'tdh.dll') but are created in unusual or non-standard system directories. The rule specifically excludes common legitimate system directories like 'System32' and 'SysWOW64' to reduce false positives. This behavior can indicate an attempt at DLL sideloading or other defense evasion techniques where an attacker places a malicious DLL with a legitimate system DLL name in a location that a legitimate application might load it from.
Sigma
