DCOM InternetExplorer.Application Iertutil DLL Hijack via Network Share

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•30

Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario. This rule specifically looks for EventID 5145 (a network share access event) where the target file path ends with `\Internet Explorer\iertutil.dll` and the `SubjectUserName` does not end with a `$` (indicating a machine account, which is filtered out to reduce false positives).