netlogon.dll
Net Logon Services DLL file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real netlogon.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionNet Logon Services DLL
2 known copies
10.0.19041.450 (WinBuild.160101.0800) · C:\Windows\SysWOW64\netlogon.dll · signed by Microsoft Windows
7a345a69c79c58e8cc0622f61eb8943ceb87fc9bc4d258cea6ef15107c82855b10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\netlogon.dll · signed by Microsoft Windows
781e04607e5d5fa85a97adde90bbec137447b105bc35730093884ccc476fbd90From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names netlogon.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.