DRAYN System.dll and shfolder.dll Drop in Windows Temp Directory

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

This rule detects the creation of 'system.dll' or 'shfolder.dll' files within Windows or AppData temporary directories. These specific filenames are frequently associated with DLL sideloading or search order hijacking techniques where malicious DLLs are masqueraded or placed in writable user-space folders for execution by legitimate processes.