CmdID / Files

ntdll.dll

NT Layer DLL file version info

Library on Windows 2 known copies with hashes 3 Sigma rules name it

Is it the real ntdll.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionNT Layer DLL

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ntdll.dll · signed by Microsoft Windows

b362b0bc83463cf58f5c0e666a76dde2aeb63a435c79642719fd32fb9fadfb13

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ntdll.dll · signed by Microsoft Windows

c44b5ed955d297c4ca4d8ef5892d8342905f65c4643862721353b1d1ebac8e5d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name ntdll.dll

highNtdllPipe Like Activity ExecutionFlorian Roth (Nextron Systems)

Sigma names ntdll.dll in 3 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.