Library / Windows

dplaysvr.exe

DirectPlay Stub · Microsoft Corporation

WindowsParsed

OriginalFilename

wcodstub.dll

Differs from file nameNames a DLLShared with other binaries

Gotchas

OriginalFilename names a DLL (wcodstub.dll), not an executable. Rules expecting .exe values miss it.
OriginalFilename doesn't match the file name: a rule using OriginalFileName: dplaysvr.exe never fires.
Same OriginalFilename as dpnsvr.exe, so OriginalFilename alone can't tell them apart.

Query snippets

logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: '\dplaysvr.exe'
    - OriginalFileName: 'wcodstub.dll'
  condition: selection

process_creation logsource. Sigma string matching is case-insensitive.

| tstats summariesonly=false count values(Processes.original_file_name) as original_file_name
    from datamodel=Endpoint.Processes
    where (Processes.original_file_name="wcodstub.dll" OR Processes.process_name="dplaysvr.exe")
    by Processes.dest Processes.process_name Processes.process_path Processes.process
| rename Processes.* as *

Endpoint.Processes data model. On raw Sysmon events the field is OriginalFileName.

DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName in~ ("wcodstub.dll")
    or FileName =~ "dplaysvr.exe"

Microsoft Defender XDR advanced hunting. in~ and =~ are case-insensitive.

process where event.type == "start" and
  (process.pe.original_file_name in~ ("wcodstub.dll") or
   process.name : "dplaysvr.exe")

ECS process.pe.original_file_name is a keyword field: in~ is case-insensitive, Kibana KQL is not.

['wcodstub.dll'].includes(String(OriginalFileName || '').toLowerCase())

Filter expression (JavaScript) for events carrying Sysmon's OriginalFileName field.

Values across builds

OriginalFilename	Builds	Arch	File version	Windows releases	Source	Sysmon
wcodstub.dll	1	x86	10.0.26100.4202		Host scan

OriginalFilename

Builds

Arch

File version

Windows releases

Source

Sysmon

wcodstub.dll

x86

10.0.26100.4202

Host scan

InternalName: wcodstub.dll · Product: Microsoft® Windows® Operating System

All 1 parsed builds

SHA256	Version	Arch	OriginalFilename	Windows releases	Signature	Source	Sysmon
0a89b5a50312…	10.0.26100.4202	x86	wcodstub.dll			Host scan

SHA256

Version

Arch

OriginalFilename

Windows releases

Signature

Source

Sysmon

0a89b5a50312…

10.0.26100.4202

x86

wcodstub.dll

Host scan

Winbindex builds link to the Microsoft symbol server copy that was hashed and parsed.