Potential DCOM InternetExplorer.Application DLL Hijack
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network. This rule specifically looks for file events where the 'System' process is writing to 'iertutil.dll' within the 'Internet Explorer' directory, which could indicate an attempt to replace or modify a legitimate DLL for malicious purposes, potentially leveraging DCOM for remote execution.
Sigma
