{"id":"8823e85d-31d8-473e-b7f4-92da070f0fc6","title":"Suspicious ShellExec_RunDLL Call Via Ordinal","description":"Detects suspicious call to the \"ShellExec_RunDLL\" exported function of SHELL32.DLL through the ordinal number to launch other commands.\nAdversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.\n","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2024-12-01","modified":"","tags":["attack.stealth","attack.t1218.011"],"technique_ids":["T1218.011"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://redcanary.com/blog/raspberry-robin/","https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/","https://github.com/SigmaHQ/sigma/issues/1009","https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html"],"source_path":"rules/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_ordinal_execution.yml","source_sha256":"96a89da383c1e94bf739742d620750073caf1e870bb60c3a0780983b6c747ce0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_ordinal_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious ShellExec_RunDLL Call Via Ordinal\nid: 8823e85d-31d8-473e-b7f4-92da070f0fc6\nrelated:\n    - id: d87bd452-6da1-456e-8155-7dc988157b7d\n      type: derived\nstatus: test\ndescription: |\n    Detects suspicious call to the \"ShellExec_RunDLL\" exported function of SHELL32.DLL through the ordinal number to launch other commands.\n    Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.\nreferences:\n    - https://redcanary.com/blog/raspberry-robin/\n    - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/\n    - https://github.com/SigmaHQ/sigma/issues/1009\n    - https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html\nauthor: Swachchhanda Shrawan Poudel\ndate: 2024-12-01\ntags:\n    - attack.stealth\n    - attack.t1218.011\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent_img:\n        ParentCommandLine|contains: 'SHELL32.DLL'\n    selection_parent_ordinal:\n        ParentCommandLine|contains:\n            # Note: The ordinal number may differ depending on the DLL version\n            # Example: rundll32 SHELL32.DLL,#572 \"cmd.exe\" \"/c calc.exe\"\n            - '#568'\n            - '#570'\n            - '#572'\n            - '#576'\n    selection_susp_cli_parent:\n        # Note: Add additional binaries and suspicious paths to increase coverage\n        - ParentCommandLine|contains:\n              - 'comspec'\n              - 'iex'\n              - 'Invoke-'\n              - 'msiexec'\n              - 'odbcconf'\n              - 'regsvr32'\n        - ParentCommandLine|contains:\n              - '\\Desktop\\'\n              - '\\ProgramData\\'\n              - '\\Temp\\'\n              - '\\Users\\Public\\'\n    selection_susp_child_img:\n        Image|endswith:\n            - '\\bash.exe'\n            - '\\bitsadmin.exe'\n            - '\\cmd.exe'\n            - '\\cscript.exe'\n            - '\\curl.exe'\n            - '\\mshta.exe'\n            - '\\msiexec.exe'\n            - '\\msxsl.exe'\n            - '\\odbcconf.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\regsvr32.exe'\n            - '\\schtasks.exe'\n            - '\\wmic.exe'\n            - '\\wscript.exe'\n    condition: all of selection_parent_* and 1 of selection_susp_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218.011","id":"T1218.011","name":"Rundll32","page":"techniques/enterprise/T1218.011/"}],"data_path":"data/detection-rules/8823e85d-31d8-473e-b7f4-92da070f0fc6.json","kind":"sigma"}