DLL Planting into System32/SysWOW64 by Non-System Processes
Detects the creation of DLL files in the `C:\Windows\System32` or `C:\Windows\SysWOW64` directories by processes that are not themselves located in these system directories. This behavior can indicate DLL planting, a technique used for persistence, privilege escalation, or defense evasion, often associated with DLL search order hijacking or side-loading. The rule excludes known legitimate activities such as printer driver installations and specific noisy legitimate software processes.
Microsoft Sentinel (KQL)
