{"id":"e593cf51-88db-4ee1-b920-37e89012a3c9","title":"Potentially Suspicious Rundll32 Activity","description":"Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities","author":"juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2019-01-16","modified":"2023-05-17","tags":["attack.stealth","attack.t1218.011"],"technique_ids":["T1218.011"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["False positives depend on scripts and administrative tools used in the monitored environment"],"references":["http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/","https://twitter.com/Hexacorn/status/885258886428725250","https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52","https://twitter.com/nas_bench/status/1433344116071583746","https://twitter.com/eral4m/status/1479106975967240209","https://twitter.com/eral4m/status/1479080793003671557"],"source_path":"rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml","source_sha256":"1db2f4cdfc3b0e05364e96aca7ec33c622ddce75ffe7eda2622afa16ae7d72a9","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious Rundll32 Activity\nid: e593cf51-88db-4ee1-b920-37e89012a3c9\nstatus: test\ndescription: Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities\nreferences:\n    - http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/\n    - https://twitter.com/Hexacorn/status/885258886428725250\n    - https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52\n    - https://twitter.com/nas_bench/status/1433344116071583746 # dfshim.dll,ShOpenVerbShortcut\n    - https://twitter.com/eral4m/status/1479106975967240209 # scrobj.dll,GenerateTypeLib\n    - https://twitter.com/eral4m/status/1479080793003671557 # shimgvw.dll,ImageView_Fullscreen\nauthor: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)\ndate: 2019-01-16\nmodified: 2023-05-17\ntags:\n    - attack.stealth\n    - attack.t1218.011\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - CommandLine|contains|all:\n              - 'javascript:'\n              - '.RegisterXLL'\n        - CommandLine|contains|all:\n              - 'url.dll'\n              - 'OpenURL'\n        - CommandLine|contains|all:\n              - 'url.dll'\n              - 'OpenURLA'\n        - CommandLine|contains|all:\n              - 'url.dll'\n              - 'FileProtocolHandler'\n        - CommandLine|contains|all:\n              - 'zipfldr.dll'\n              - 'RouteTheCall'\n        - CommandLine|contains|all:\n              - 'shell32.dll'\n              - 'Control_RunDLL'\n        - CommandLine|contains|all:\n              - 'shell32.dll'\n              - 'ShellExec_RunDLL'\n        - CommandLine|contains|all:\n              - 'mshtml.dll'\n              - 'PrintHTML'\n        - CommandLine|contains|all:\n              - 'advpack.dll'\n              - 'LaunchINFSection'\n        - CommandLine|contains|all:\n              - 'advpack.dll'\n              - 'RegisterOCX'\n        - CommandLine|contains|all:\n              - 'ieadvpack.dll'\n              - 'LaunchINFSection'\n        - CommandLine|contains|all:\n              - 'ieadvpack.dll'\n              - 'RegisterOCX'\n        - CommandLine|contains|all:\n              - 'ieframe.dll'\n              - 'OpenURL'\n        - CommandLine|contains|all:\n              - 'shdocvw.dll'\n              - 'OpenURL'\n        - CommandLine|contains|all:\n              - 'syssetup.dll'\n              - 'SetupInfObjectInstallAction'\n        - CommandLine|contains|all:\n              - 'setupapi.dll'\n              - 'InstallHinfSection'\n        - CommandLine|contains|all:\n              - 'pcwutl.dll'\n              - 'LaunchApplication'\n        - CommandLine|contains|all:\n              - 'dfshim.dll'\n              - 'ShOpenVerbApplication'\n        - CommandLine|contains|all:\n              - 'dfshim.dll'\n              - 'ShOpenVerbShortcut'\n        - CommandLine|contains|all:\n              - 'scrobj.dll'\n              - 'GenerateTypeLib'\n              - 'http'\n        - CommandLine|contains|all:\n              - 'shimgvw.dll'\n              - 'ImageView_Fullscreen'\n              - 'http'\n        - CommandLine|contains|all:\n              - 'comsvcs.dll'\n              - 'MiniDump'\n    filter_main_screensaver:\n        CommandLine|contains: 'shell32.dll,Control_RunDLL desk.cpl,screensaver,@screensaver'\n    filter_main_parent_cpl:  # Settings\n        ParentImage: 'C:\\Windows\\System32\\control.exe'\n        ParentCommandLine|contains: '.cpl'\n        CommandLine|contains|all:\n            - 'Shell32.dll'\n            - 'Control_RunDLL'\n            - '.cpl'\n    filter_main_startmenu:\n        ParentImage: 'C:\\Windows\\System32\\control.exe'\n        CommandLine|startswith: '\"C:\\Windows\\system32\\rundll32.exe\" Shell32.dll,Control_RunDLL \"C:\\Windows\\System32\\'\n        CommandLine|endswith: '.cpl\",'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - False positives depend on scripts and administrative tools used in the monitored environment\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218.011","id":"T1218.011","name":"Rundll32","page":"techniques/enterprise/T1218.011/"}],"data_path":"data/detection-rules/e593cf51-88db-4ee1-b920-37e89012a3c9.json","kind":"sigma"}