DLL Drop to Network Share - Possible DLL Hijack

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects attempts to drop a DLL file to a network share, specifically targeting the 'ADMIN$' share, which could indicate a DLL hijacking attempt. It monitors SMB traffic on port 445 for established connections and looks for content containing '.dll' and 'ADMIN$' (case-insensitive).