{"id":"a7c3d773-caef-227e-a7e7-c2f13c622329","title":"Bad Opsec Defaults Sacrificial Processes With Improper Arguments","description":"Detects attackers using tooling with bad opsec defaults.\nE.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run.\nOne trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.\n","author":"Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2020-10-23","modified":"2024-08-15","tags":["attack.stealth","attack.t1218.011"],"technique_ids":["T1218.011"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/","https://www.cobaltstrike.com/help-opsec","https://twitter.com/CyberRaiju/status/1251492025678983169","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regsvr32","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32","https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool","https://learn.microsoft.com/en-us/dotnet/framework/tools/regsvcs-exe-net-services-installation-tool"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes.yml","source_sha256":"1d4559cda59ded2d2895b084b2f9e26fc04e5f7dc6f45c0dcd1ba5f54fbbac52","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Bad Opsec Defaults Sacrificial Processes With Improper Arguments\nid: a7c3d773-caef-227e-a7e7-c2f13c622329\nrelated:\n    - id: f5647edc-a7bf-4737-ab50-ef8c60dc3add\n      type: obsolete\nstatus: test\ndescription: |\n    Detects attackers using tooling with bad opsec defaults.\n    E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run.\n    One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.\nreferences:\n    - https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/\n    - https://www.cobaltstrike.com/help-opsec\n    - https://twitter.com/CyberRaiju/status/1251492025678983169\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regsvr32\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32\n    - https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool\n    - https://learn.microsoft.com/en-us/dotnet/framework/tools/regsvcs-exe-net-services-installation-tool\nauthor: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)\ndate: 2020-10-23\nmodified: 2024-08-15\ntags:\n    - attack.stealth\n    - attack.t1218.011\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_werfault:\n        Image|endswith: '\\WerFault.exe'\n        CommandLine|endswith: 'WerFault.exe'\n    selection_rundll32:\n        Image|endswith: '\\rundll32.exe'\n        CommandLine|endswith: 'rundll32.exe'\n    selection_regsvcs:\n        Image|endswith: '\\regsvcs.exe'\n        CommandLine|endswith: 'regsvcs.exe'\n    selection_regasm:\n        Image|endswith: '\\regasm.exe'\n        CommandLine|endswith: 'regasm.exe'\n    selection_regsvr32:\n        Image|endswith: '\\regsvr32.exe'\n        CommandLine|endswith: 'regsvr32.exe'\n    filter_optional_edge_update:\n        ParentImage|contains: '\\AppData\\Local\\Microsoft\\EdgeUpdate\\Install\\{'\n        Image|endswith: '\\rundll32.exe'\n        CommandLine|endswith: 'rundll32.exe'\n    filter_optional_chromium_installer:\n        # As reported in https://github.com/SigmaHQ/sigma/issues/4570 and others\n        ParentImage|contains:\n            - '\\AppData\\Local\\BraveSoftware\\Brave-Browser\\Application\\'\n            - '\\AppData\\Local\\Google\\Chrome\\Application\\'\n        ParentImage|endswith: '\\Installer\\setup.exe'\n        ParentCommandLine|contains: '--uninstall '\n        Image|endswith: '\\rundll32.exe'\n        CommandLine|endswith: 'rundll32.exe'\n    condition: 1 of selection_* and not 1 of filter_optional_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218.011","id":"T1218.011","name":"Rundll32","page":"techniques/enterprise/T1218.011/"}],"data_path":"data/detection-rules/a7c3d773-caef-227e-a7e7-c2f13c622329.json","kind":"sigma"}