{"id":"cd3d1298-eb3b-476c-ac67-12847de55813","title":"DLL Execution via Rasautou.exe","description":"Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.","author":"Julia Fomina, oscd.community","status":"test","level":"medium","date":"2020-10-09","modified":"","tags":["attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"product":"windows","category":"process_creation","definition":"Since options '-d' and '-p' were removed in Windows 10 this rule is relevant only for Windows before 10. And as Windows 7 doesn't log command line in 4688 by default, to detect this attack you need Sysmon 1 configured or KB3004375 installed for command-line auditing (https://support.microsoft.com/en-au/help/3004375/microsoft-security-advisory-update-to-improve-windows-command-line-aud)"},"falsepositives":["Unlikely"],"references":["https://lolbas-project.github.io/lolbas/Binaries/Rasautou/","https://github.com/fireeye/DueDLLigence","https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html"],"source_path":"rules/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml","source_sha256":"ffec4d88b229ead277eaf05bc0767607da7fd8dbbf1e8f227d3926f37905e1f6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DLL Execution via Rasautou.exe\nid: cd3d1298-eb3b-476c-ac67-12847de55813\nstatus: test\ndescription: Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Rasautou/\n    - https://github.com/fireeye/DueDLLigence\n    - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html\nauthor: Julia Fomina, oscd.community\ndate: 2020-10-09\ntags:\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    product: windows\n    category: process_creation\n    definition: Since options '-d' and '-p' were removed in Windows 10 this rule is relevant only for Windows before 10. And as Windows 7 doesn't log command line in 4688 by default, to detect this attack you need Sysmon 1 configured or KB3004375 installed for command-line auditing (https://support.microsoft.com/en-au/help/3004375/microsoft-security-advisory-update-to-improve-windows-command-line-aud)\ndetection:\n    selection_img:\n        - Image|endswith: '\\rasautou.exe'\n        - OriginalFileName: 'rasdlui.exe'\n    selection_cli:\n        CommandLine|contains|all:\n            - ' -d '\n            - ' -p '\n    condition: all of selection*\nfalsepositives:\n    - Unlikely\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/cd3d1298-eb3b-476c-ac67-12847de55813.json","kind":"sigma"}