Weaponized Files Extracting DLL Files After Execution

Query

DeviceFileEvents
| extend FileOriginReferrerUrl_ext = extract(@"[^\\]+$", 0, FileOriginReferrerUrl)
| where isnotempty( FileOriginReferrerUrl)
| join kind=inner ( DeviceEvents) on $left.InitiatingProcessUniqueId == $right.InitiatingProcessUniqueId
| extend FilesExtension = extract(@"\.([a-zA-Z0-9]+)$", 1, FileName)
| extend OriginalFileExtension = extract(@"\.([a-zA-Z0-9]+)$", 1, FileOriginReferrerUrl_ext)
| extend Source_Type = case(FileOriginReferrerUrl startswith "http","🌎 Web","📂 File")
| where OriginalFileExtension !in ("zip","7z") and FilesExtension endswith ".dll"
| summarize total_Files= dcount(FileName), Files_after_execution= strcat("🗂️ ",make_set(FileName)),make_set(FilesExtension),make_set(ActionType),make_set(FolderPath),SHA256_Group=make_set(SHA2561) by InitiatingProcessUniqueId,AccountUpn = strcat("👩🏻💻🧑🏾💻",InitiatingProcessAccountUpn), Device = strcat("💻 ",DeviceName), FileOriginReferrerUrl,Source_Type, OriginalFile=strcat("🚩 ",FileOriginReferrerUrl_ext), OriginalFileExtension, ReportId, TimeGenerated, Timestamp, DeviceId

About this query

MITRE ATT&CK Technique(s)

Technique ID	Title
T1203	Exploitation for Client Execution

Author: Sergio Albea (23/04/2025)

Weaponized files extracting .DLL files after execution

Description: When Weaponize files such as Word documents are opened, they can immediately extracts a disguised DLL file into the system’s temporary folder while simultaneously exploiting the Equation Editor vulnerability to execute the extracted file.The following query can help to identify when either a Word or another unusual file (I am whitelisting zip ones) extract a DLL file once is executed.

Explanation

This query is designed to detect suspicious activity related to the execution of weaponized files, such as Word documents, that extract DLL files upon execution. Here's a simplified breakdown of what the query does:

Data Source: It analyzes events from DeviceFileEvents and DeviceEvents to track file activities on a device.
File Origin Tracking: It extracts the origin of files (e.g., from the web or a file) and checks if the file origin is not empty.
File Extension Analysis: It identifies the file extensions of both the original file and the extracted files. It focuses on files that end with .dll (dynamic link library files) and excludes common compressed file types like .zip and .7z.
Event Correlation: It joins file events with device events based on a unique process identifier to correlate the execution of files with their origins.
Suspicious Activity Detection: The query looks for scenarios where a non-compressed file (excluding .zip and .7z) extracts a .dll file, which could indicate exploitation activity.
Summary and Reporting: It summarizes the findings by counting distinct file names, listing the extracted files, their extensions, actions taken, folder paths, and SHA256 hashes. It also provides details about the initiating process, user account, device, and file origin.
Output: The results include information about the user account, device, original file, and source type, along with timestamps and other identifiers to help in further investigation.

Overall, this query helps security analysts identify potential exploitation attempts where weaponized files extract and execute DLL files, potentially indicating malicious activity.

Details

Sergio Albea

Released: July 21, 2026

Tables

DeviceFileEventsDeviceEvents

Keywords

DeviceFileEventsNameOriginReferrerUrlInitiatingProcessUniqueIdAccountUpnReportTimeGeneratedTimestamp

Operators

extendextractwhereisnotemptyjoinonendswithsummarizedcountstrcatmake_setcasestartswith

MITRE Techniques

T1203

Actions

GitHub

KQL Search