DRAYN System.dll Drop to Windows\Temp for DLL Masquerading

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects the creation or modification of a file named 'System.dll' within a subdirectory of the 'C:\Windows\Temp' directory where the writing process is not signed by Microsoft. This behavior is indicative of potential DLL sideloading or masquerading attempts, where an attacker drops a malicious DLL in a writable directory to be loaded by a legitimate process.