Detection: Windows Potential AppDomainManager Hijack Artifacts Creation

Updated Date: 2025-12-10 ID: be19b369-fd0c-42be-ae97-c10b6c01638f Author: Teoderick Contreras, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects the creation of an .exe file along with its corresponding .exe.config and a .dll in the same directory, which is a common pattern indicative of potential AppDomain hijacking or CLR code injection attempts. This behavior may signal that a malicious actor is attempting to load a rogue assembly into a legitimate application's AppDomain, allowing code execution under the context of a trusted process.

Search

 1
 2| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime from datamodel=Endpoint.Filesystem
 3where Filesystem.file_name IN ("*.exe", "*.exe.config", "*.dll") AND Filesystem.file_path IN
 4  ("*\\windows\\fonts\\*", "*\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*","*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\PerfLogs\\*")
 5AND Filesystem.action = "created"
 6by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product
 7
 8| `drop_dm_object_name("Filesystem")`
 9
10| stats values(file_name) AS file_name
11        values(file_path) AS file_path
12        values(user) AS user
13        min(firstTime) AS firstTime max(lastTime) AS lastTime
14        BY dest process_guid
15
16| eval exe_present = if(mvcount(mvfilter(match(file_name, "\.exe$"))) > 0, 1, 0)
17
18| eval config_present = if(mvcount(mvfilter(match(file_name, "\.exe\.config$"))) > 0, 1, 0)
19
20| eval dll_present = if(mvcount(mvfilter(match(file_name, "\.dll$"))) > 0, 1, 0)
21
22
23| eval exe_files = mvfilter(match(file_name, "\.exe$") AND NOT match(file_name, "\.exe\.config$"))
24
25| eval config_files = mvfilter(match(file_name, "\.exe\.config$"))
26
27| eval exe_base_names = mvmap(exe_files, replace(exe_files, "\.exe$", ""))
28
29| eval config_base_names = mvmap(config_files, replace(config_files, "\.exe\.config$", ""))
30  
31
32| mvexpand exe_base_names
33
34| mvexpand config_base_names
35
36
37| eval file_count = mvcount(file_name)
38
39
40| where file_count >= 3 AND exe_present = 1 AND config_present = 1 AND dll_present = 1 AND exe_base_names = config_base_names
41
42| `security_content_ctime(firstTime)`
43
44| `security_content_ctime(lastTime)`
45
46| `windows_potential_appdomainmanager_hijack_artifacts_creation_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 11	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
windows_potential_appdomainmanager_hijack_artifacts_creation_filter	`search *`

windows_potential_appdomainmanager_hijack_artifacts_creation_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1574.014	AppDomainManager	Defense Evasion

Exploitation

Installation

DE.AE

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	True

This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Filesystem node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.

Known False Positives

This detection may still produce false positives, so additional filtering is recommended. To validate potential alerts, verify that the executable’s original file name matches its current file name, and also review the associated .config file to confirm which DLLs are expected to load during execution. This helps distinguish legitimate activity from suspicious behavior.

Associated Analytic Story

SesameOp

Risk Based Analytics (RBA)

Risk Message:

Potential Windows AppDomainManager hijack artifact files created on [$dest$]

Risk Object	Risk Object Type	Risk Score	Threat Objects
dest	system	20	file_path, file_name

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1