Remote DLL Injection via UNC Path Write

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•8

This rule detects attempts to perform remote DLL injection via UNC path writes over SMB. It specifically looks for SMB traffic to port 445 on the home network, containing ".dll", "\\", and "System32" in a case-insensitive manner. This combination suggests an attempt to write a DLL file to a System32 directory on a remote machine using a UNC path, which is a common technique for DLL injection.