Detection: Windows SCCM Adsource DLL Was Planted In SMS Provider Directory

Updated Date: 2026-08-20 ID: 4f55b07b-7aeb-47f4-a234-b222a902276b Author: Raven Tait, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects the creation or modification of adsource.dll or other staging files with the name adsource_*.dll within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301. This abuses a DLL side-loading vulnerability in the Microsoft Configuration Manager SMS Provider component. An attacker can plant a malicious adsource.dll in the SCCMProvider bin\X64 path, causing the SMS Provider service to load the attacker-controlled library in a privileged context. The presence of renamed dlls alongside adsource.dll is a strong indicator of the classic DLL hijacking pattern where the legitimate library has been renamed so the malicious replacement can proxy calls to it. If confirmed malicious, this activity represents a privilege escalation vector that can result in SYSTEM-level code execution on any host running the SCCM SMS Provider role.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5
 6from datamodel=Endpoint.Filesystem where
 7
 8Filesystem.action IN ("created", "modified")
 9Filesystem.file_name IN (
10    "adsource.dll",
11    "adsource_*.dll"
12)
13Filesystem.file_path="*Microsoft Configuration Manager\\bin\\X64\\*"
14
15BY Filesystem.action Filesystem.dest Filesystem.file_access_time
16    Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
17    Filesystem.file_name Filesystem.file_path Filesystem.file_acl
18    Filesystem.file_size Filesystem.process_guid Filesystem.process_id
19    Filesystem.user Filesystem.vendor_product
20
21
22| `drop_dm_object_name(Filesystem)`
23
24| `security_content_ctime(firstTime)`
25
26| `security_content_ctime(lastTime)`
27
28| `windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 11	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter	`search *`

windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1574.002	DLL Side-Loading	Execution

Exploitation

Installation

DE.CM

CIS 10

CVE

CVE-2026-47301

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Filesystem node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64" folder.

Known False Positives

Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory. Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning.

Associated Analytic Story

Windows Privilege Escalation

Finding

Title	Entity Field	Entity Type	Risk Score
Suspicious SCCM adsource DLL [$file_name$] detected at [$file_path$] on [$dest$]	dest	system	50

Threat Objects

Field	Type
file_path	file_path
file_name	file_name

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1