Detect DeadVax Fake _windows.dll_ Payload
Malware sometimes creates files with names that look like system files. In this attack, it creates a file with a name that sounds like a Windows DLL. But the file is not a real DLL. It is a text file that holds hidden, encoded data. The malware uses it to pass data between stages of the attack. A script creates this file, not a normal program install. It appears in temp or ProgramData folders, which are common places for malware to hide. Real DLLs are usually installed by installers in specific system folders. Security teams should treat this exact filename being created by a script as highly suspicious. This rule helps catch that behaviour before the next stage runs.
Sigma
