title: Rename Common File to DLL File
id: bbfd974c-248e-4435-8de6-1e938c79c5c1
status: experimental
description: Detects cases in which a file gets renamed to .dll, which often happens to bypass perimeter protection
references:
    - https://twitter.com/ffforward/status/1481672378639912960
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md#atomic-test-1---system-file-copied-to-unusual-location
author: frack113
date: 2022/02/19
modified: 2022/03/13
logsource:
    product: windows
    category: file_rename
detection:
    to_dll:
        TargetFilename|endswith: '.dll'
    filter_from_dll:
        - OriginalFilename|endswith: 
            - '.dll'
            - '.tmp'  # VSCode FP
        - OriginalFilename|contains: 
            - '.dll.'
            - '\SquirrelTemp\temp'
    filter_tiworker:
        Image|startswith: 'C:\Windows\WinSxS\'
        Image|endswith: '\TiWorker.exe'
    condition: to_dll and not 1 of filter*
falsepositives:
    - Application installation
level: medium
