duser.dll
Windows DirectUser Engine file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real duser.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows DirectUser Engine
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\duser.dll · signed by Microsoft Windows
0a8f8eea79d47159053d23fc154ecbb12cde8d1ebe09908f5791073d7f3539b410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\duser.dll · signed by Microsoft Windows
21fcfc15a6faf8a5c6d9448bba70fb1b12c450c8a55dc9de1eba446b6e03e8ccFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names duser.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.