Detection: Windows Phantom DLL Created on Disk

Updated Date: 2026-08-20 ID: 34cb2dfb-1dec-4b6b-bc72-c3904e5e4521 Author: Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects creation of DLL files with names associated with phantom DLL hijacking opportunities. These DLLs are usually absent from standard Windows installations, but legitimate Windows components or services may attempt to load them when they are present in expected search paths such as System32. Phantom DLL hijacking involves placing a malicious DLL where a legitimate process will search for a non-existent dependency, allowing the attacker-controlled library to execute in that process context. ShieldBreak is one example where the exploit redirects a privileged Defender-driven write into C:\Windows\System32\phoneinfo.dll and then triggers Windows Error Reporting so wermgr.exe loads the planted DLL at SYSTEM integrity. If confirmed malicious, this activity can indicate preparation for code execution, persistence, or local privilege escalation through DLL search order hijacking.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5from datamodel=Endpoint.Filesystem where
 6
 7Filesystem.action IN ("created","modified")
 8
 9Filesystem.file_path IN (
10    "*:\\Windows\\System32\\axeonoffhelper.dll",
11    "*:\\Windows\\System32\\cdpsgshims.dll",
12    "*:\\Windows\\System32\\oci.dll",
13    "*:\\Windows\\System32\\offdmpsvc.dll",
14    "*:\\Windows\\System32\\shellchromeapi.dll",
15    "*:\\Windows\\System32\\TSMSISrv.dll",
16    "*:\\Windows\\System32\\TSVIPSrv.dll",
17    "*:\\Windows\\System32\\wbem\\wbemcomn.dll",
18    "*:\\Windows\\System32\\WLBSCTRL.dll",
19    "*:\\Windows\\System32\\wow64log.dll",
20    "*:\\Windows\\System32\\WptsExtensions.dll",
21    "*\\phoneinfo.dll",
22    "*\\SprintCSP.dll"
23)
24by Filesystem.action Filesystem.dest Filesystem.file_hash
25   Filesystem.file_name Filesystem.file_path Filesystem.process_id
26   Filesystem.user Filesystem.vendor_product
27
28
29| `drop_dm_object_name(Filesystem)`
30
31| `security_content_ctime(firstTime)`
32
33| `security_content_ctime(lastTime)`
34
35| `windows_phantom_dll_created_on_disk_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 11	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
security_content_summariesonly	`summariesonly=`summariesonly_config `allow_old_summaries=`oldsummaries_config `fillnull_value=`fillnull_config``
windows_phantom_dll_created_on_disk_filter	`search *`

windows_phantom_dll_created_on_disk_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1574.001	DLL	Execution

Exploitation

Installation

DE.CM

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

To successfully implement this search, you need file creation telemetry from Windows endpoints mapped into the Endpoint.Filesystem datamodel. If you are using Sysmon, enable EventID 11 and ensure the FileCreate configuration captures the full target filename for DLL creations in Windows system paths.

Known False Positives

Some legacy or third-party components may create DLLs with these names for legitimate compatibility reasons, but creation in Windows system paths should be uncommon. Review the creating process, signer, file hash, path, and whether the DLL is expected on the host before tuning.

Associated Analytic Story

Finding

Title	Entity Field	Entity Type	Risk Score
A phantom DLL candidate named [$file_name$] was created at [$file_path$] on [$dest$]	dest	system	50

Threat Objects

Field	Type
file_name	file_name
file_path	file_path

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 2