This analytic detects the creation or modification of adsource.dll or adsource_*.dll within the Microsoft Configuration Manager (SCCM) SMS Provider bin directory (bin\X64). The behavior aligns with exploitation of CVE-2026-47301, a DLL side-loading vulnerability in the SMS Provider component that can allow an attacker to substitute a malicious DLL and load it in the SMS Provider process, typically running with elevated privileges. A key indicator is the appearance or renaming of DLLs in the SMS Provider bin\X64 path, which signals a DLL hijacking pattern where the legitimate library is replaced or proxied by a malicious counterpart. The rule leverages endpoint telemetry (Sysmon FileCreate events) to flag file creations or modifications for adsource.dll or adsource_*.dll located under Microsoft Configuration Manager\bin\X64. The detection is implemented as a Splunk search over the Endpoint.Filesystem data model, returning details such as the destination host, file_path, file_name, timestamps, file hash, and associated process/user context to enable rapid investigation and containment. This alert is categorized under Windows Privilege Escalation (ATT&CK T1574.002) and references CVE-2026-47301 as the underlying vulnerability. The presence of such a DLL in the SMS Provider directory on systems with the SMS Provider role is a high-severity signal that could lead to SYSTEM-level code execution. The rule includes guidance on implementation (ingesting process context with filesystem events, ensuring Sysmon FileCreate is enabled, and that CIM App 4.20+ or higher and the latest endpoint TA are installed) and notes legitimate false positives such as SCCM upgrades or hotfix installations that may legitimately place or replace adsource.dll. Hash/signature validation of adsource.dll against the installed SCCM build is recommended to reduce false positives, along with monitoring for accompanying renamed DLLs and other DLL hijacking indicators.