Stupig masquerading DLL kbdus1.dll detected in System32
This rule detects the creation or presence of a file named 'kbdus1.dll' within the Windows System32 directory. This filename is designed to look like the legitimate Windows keyboard layout DLL 'kbdus.dll' by appending a '1'. Threat actors, specifically associated with the Stupig backdoor, utilize this masquerading technique to blend in with legitimate system files and evade detection by security monitoring tools that rely on filename-based filtering.
Microsoft Sentinel (KQL)
