Query: write Sigma for Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch
Matching passage: Sigma rule: Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch. Logsource: windows / process_creation. Rule: title: Suspicious ShellExec_RunDLL Call Via Ordinal id: 8823e85d-31d8-473e-b7f4-92da070f0fc6 related: - id: d87bd452-6da1-456e-8155-7dc988157b7d type: derived status: test description: 'Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine. ' references: - https://redcanary.com/blog/raspberry-robin/ - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - https://github.com/SigmaHQ/sigma/issues/1009 - https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html author: Swachchhanda Shrawan Poudel date: 2024-12-01 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_parent_img: ParentCommandLine|contains: SHELL32.DLL selection_parent_ordinal: ParentCommandLine|contains: - '#568' - '#570' - '#572' - '#576' selection_susp_cli_parent: - ParentCommandLine|contains: - comspec - iex - Invoke- - msiexec - odbcconf - regsvr32 - ParentCommandLine|contains: - \Desktop\ - \ProgramData\ - \Temp\ - \Users\Public\ selection_susp_child_img: Image|endswith: - \bash.exe - \bitsadmin.exe - \cmd.exe - \cscript.exe - \curl.exe - \mshta.exe - \msiexec.exe - \msxsl.exe - \odbcconf.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \schtasks.exe - \wmic.exe - \wscript.exe condition: all of selection_parent_* and 1 of selection_susp_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svc. Logsource: windows / registry_set. Rule: title: Scheduled TaskCache Change by Uncommon Program id: 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d status: test description: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://labs.f-secure.com/blog/scheduled-task-tampering/ author: Syed Hasan (@syedhasan009) date: 2021-06-18 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053 - attack.t1053.005 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\ filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_other: TargetObject|contains: - Microsoft\Windows\UpdateOrchestrator - Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask\Index - Microsoft\Windows\Flighting\OneSettings\RefreshCache\Index filter_main_mousocoreworker: Image|endswith: C:\Windows\System32\MoUsoCoreWorker.exe filter_main_services: Image|endswith: C:\Windows\System32\services.exe filter_main_tiworker: Image|startswith: C:\Windows\ Image|endswith: \TiWorker.exe filter_main_svchost: Image: C:\WINDOWS\system32\svchost.exe filter_main_ngen: Image|startswith: C:\Windows\Microsoft.NET\Framework Image|endswith: \ngen.exe TargetObject|contains: - \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B66B135D-DA06-4FC4-95F8-7458E1D10129} - \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\.NET Framework\.NET Framework NGEN filter_main_office: Image: - C:\Program Files\Microsoft Office\root\Integration\Integrator.exe - C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe - C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe - C:\Program Files (x86)\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe filter_main_msiexec: Image: C:\Windows\System32\msiexec.exe filter_main_explorer: Image: C:\Windows\explorer.exe TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\Server Manager Performance Monitor\ filter_main_system: Image: System filter_main_runtimebroker: Image: C:\Windows\System32\RuntimeBroker.exe filter_optional_dropbox_updater: Image: - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - C:\Program Files\Dropbox\Update