Suspicious DLL Files Written to User Profile Directories
Detects DLL files written to common Windows user directories, including Desktop, Downloads, Pictures, Videos, Documents, Music, and other user profile folders. These files may be written by archive extraction utilities such as Windows Explorer, 7-Zip, or WinRAR, web browsers during downloads, or other applications. User-accessible directories are common staging locations for files involved in cyberattacks. Attackers may distribute ZIP archives through phishing emails containing a legitimate-looking executable alongside a malicious DLL. After the user extracts the archive and executes the executable, it may load the malicious DLL from the same directory, enabling DLL side-loading and potentially allowing malicious code to execute within a trusted process. Similar activity may occur when DLLs are downloaded or placed directly into other user profile folders. This detection groups events by endpoint and file path, providing DLL file names, vendor information, SHA256 hashes, the associated process or file context, and the first-seen timestamp to support investigation and triage. As this is a single-signal detection, it may also identify legitimate software installations, portable applications, development tools, and other benign file operations. Validate the DLL's hash, vendor information, associated process, file location, and source archive or download before escalating the alert.
CQL
