Detection of PowerShell-Based DLL Placement in System Directories

This threat brief focuses on the behavioral detection of PowerShell scripts used to copy or move files, specifically malicious DLLs, into sensitive Windows system directories such as C:\Windows\System32 or C:\Windows\SysWOW64. This activity is frequently observed in post-exploitation scenarios where an attacker seeks to establish persistence or facilitate credential access, such as by installing a custom password filter DLL. By moving binaries into these directories, attackers often attempt to blend in with legitimate system files or exploit search order hijacking vulnerabilities. Defenders must monitor PowerShell Script Block logging (Event ID 4104) to identify these administrative operations initiated by potentially compromised user or service accounts.

Attack Chain

1. Initial compromise of a workstation or server via phishing or exploit.
2. Execution of a PowerShell command to locate or download a malicious DLL payload.
3. Escalation of privileges to reach the level required for writing into protected directories.
4. Use of Copy-Item or cpi PowerShell cmdlets to move the malicious DLL into a target path within System32 or SysWOW64.
5. Modification of registry keys (e.g., Notification Packages or Password Filters) to link the dropped DLL.
6. Service restart or system reboot to force the loading of the malicious DLL by system processes.
7. Final objective achieved: persistent code execution in the context of high-privileged system processes for credential dumping or C2.

Impact

Successful execution allows attackers to maintain persistent access to the host, bypass security controls, and capture sensitive credentials (such as plaintext passwords or NTLM hashes) directly from the LSASS process, potentially leading to domain-wide compromise.

Recommendation

1. Enable PowerShell Script Block Logging (Event ID 4104) to capture the full command strings executed by PowerShell.
2. Deploy the provided Sigma rule to identify unauthorized file operations targeting sensitive directories.
3. Implement File Integrity Monitoring (FIM) on C:\Windows\System32 and C:\Windows\SysWOW64 to alert on the creation of new, unexpected DLLs.
4. Enforce strict least-privilege policies to ensure that standard user or service accounts cannot write to protected system directories.