Query: rule covering Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch
Matching passage: Sigma rule: Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch. Logsource: windows / process_creation. Rule: title: Suspicious ShellExec_RunDLL Call Via Ordinal id: 8823e85d-31d8-473e-b7f4-92da070f0fc6 related: - id: d87bd452-6da1-456e-8155-7dc988157b7d type: derived status: test description: 'Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine. ' references: - https://redcanary.com/blog/raspberry-robin/ - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - https://github.com/SigmaHQ/sigma/issues/1009 - https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html author: Swachchhanda Shrawan Poudel date: 2024-12-01 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_parent_img: ParentCommandLine|contains: SHELL32.DLL selection_parent_ordinal: ParentCommandLine|contains: - '#568' - '#570' - '#572' - '#576' selection_susp_cli_parent: - ParentCommandLine|contains: - comspec - iex - Invoke- - msiexec - odbcconf - regsvr32 - ParentCommandLine|contains: - \Desktop\ - \ProgramData\ - \Temp\ - \Users\Public\ selection_susp_child_img: Image|endswith: - \bash.exe - \bitsadmin.exe - \cmd.exe - \cscript.exe - \curl.exe - \mshta.exe - \msiexec.exe - \msxsl.exe - \odbcconf.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \schtasks.exe - \wmic.exe - \wscript.exe condition: all of selection_parent_* and 1 of selection_susp_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.. Logsource: linux / process_creation. Rule: title: ESXi VM List Discovery Via ESXCLI id: 5f1573a7-363b-4114-9208-ad7a61de46eb status: test description: Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs. references: - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/ - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/ - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html author: Cedric Maurugeon date: 2023-09-04 tags: - attack.discovery - attack.execution - attack.t1033 - attack.t1007 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection: Image|endswith: /esxcli CommandLine|contains: vm process CommandLine|endswith: ' list' condition: selection falsepositives: - Legitimate administration activities level: medium