This analytic flags the creation of DLLs whose names are commonly associated with phantom DLL hijacking techniques and that appear in Windows search paths (notably System32). By monitoring Sysmon EventID 11 FileCreate events via the Endpoint.Filesystem data model, it detects when a process creates or modifies a suspicious DLL in Windows system directories (e.g., axeonoffhelper.dll, cdpsgshims.dll, oci.dll, offdmpsvc.dll, shellchromeapi.dll, TSMSISrv.dll, TSVIPSrv.dll, wbemcomn.dll, WLBSCTRL.dll, wow64log.dll, WptsExtensions.dll, phoneinfo.dll, SprintCSP.dll). The presence of such a DLL in a process's startup/search path can enable DLL search order hijacking, allowing attacker-controlled code to run in the context of a privileged process such as wermgr.exe. The finding represents a phantom DLL candidate named [$file_name$] at [$file_path$] on [$dest$], and is associated with MITRE techniques T1574.001 (DLL Search Order Hijacking) and T1068 (Exploitation for Privilege Escalation). It is mapped to the RoguePlanet/Windows Privilege Escalation/Defense Evasion storyline and is actionable against endpoint sensors (Splunk Enterprise/Splunk ES/Splunk Cloud). The rule includes a test dataset (ShieldBreak phoneinfo_dll_created.log) and guidance to enable full target filename capture for Sysmon EventID 11; however, legitimate software may occasionally create such DLLs, so verify the creating process, signer, and file hash before tuning.