some legacy or third-party components may create dlls with these names for legitimate compatibility reasons, but creation in windows system paths should be uncommon. review the creating process, signer, file hash, path, and whether the dll is expected on the host before tuning.

splunk

Techniques

Sample rules

Windows Phantom DLL Created on Disk

source: splunk
technicques:

Description

The following analytic detects creation of DLL files with names associated with phantom DLL hijacking opportunities. These DLLs are usually absent from standard Windows installations, but legitimate Windows components or services may attempt to load them when they are present in expected search paths such as System32. Phantom DLL hijacking involves placing a malicious DLL where a legitimate process will search for a non-existent dependency, allowing the attacker-controlled library to execute in that process context. ShieldBreak is one example where the exploit redirects a privileged Defender-driven write into C:\Windows\System32\phoneinfo.dll and then triggers Windows Error Reporting so wermgr.exe loads the planted DLL at SYSTEM integrity. If confirmed malicious, this activity can indicate preparation for code execution, persistence, or local privilege escalation through DLL search order hijacking.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime
from datamodel=Endpoint.Filesystem where

Filesystem.action IN ("created","modified")

Filesystem.file_path IN (
    "*:\\Windows\\System32\\axeonoffhelper.dll",
    "*:\\Windows\\System32\\cdpsgshims.dll",
    "*:\\Windows\\System32\\oci.dll",
    "*:\\Windows\\System32\\offdmpsvc.dll",
    "*:\\Windows\\System32\\shellchromeapi.dll",
    "*:\\Windows\\System32\\TSMSISrv.dll",
    "*:\\Windows\\System32\\TSVIPSrv.dll",
    "*:\\Windows\\System32\\wbem\\wbemcomn.dll",
    "*:\\Windows\\System32\\WLBSCTRL.dll",
    "*:\\Windows\\System32\\wow64log.dll",
    "*:\\Windows\\System32\\WptsExtensions.dll",
    "*\\phoneinfo.dll",
    "*\\SprintCSP.dll"
)
by Filesystem.action Filesystem.dest Filesystem.file_hash
   Filesystem.file_name Filesystem.file_path Filesystem.process_id
   Filesystem.user Filesystem.vendor_product


| `drop_dm_object_name(Filesystem)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_phantom_dll_created_on_disk_filter`