StructuredQuery.dll
Structured Query file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real StructuredQuery.dll?
C:\Windows\system32\C:\Windows\SysWOW64\2 known copies
7.0.19041.388 (WinBuild.160101.0800) · C:\Windows\system32\StructuredQuery.dll · signed by Microsoft Windows
0229d6571c613355d2337009265f742b807d98afcf5a5e34fd74fc38f1d03b1c7.0.19041.388 (WinBuild.160101.0800) · C:\Windows\SysWOW64\StructuredQuery.dll · signed by Microsoft Windows
5232a60c33e94d9abc30986cbeb8e7bebda91191df6f92d5aec73f4607da89f8From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names StructuredQuery.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.