Query: Sigma rule for Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities
Matching passage: Sigma rule: Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Rundll32 Activity id: e593cf51-88db-4ee1-b920-37e89012a3c9 status: test description: Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities references: - http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/ - https://twitter.com/Hexacorn/status/885258886428725250 - https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52 - https://twitter.com/nas_bench/status/1433344116071583746 - https://twitter.com/eral4m/status/1479106975967240209 - https://twitter.com/eral4m/status/1479080793003671557 author: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2023-05-17 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: - CommandLine|contains|all: - 'javascript:' - .RegisterXLL - CommandLine|contains|all: - url.dll - OpenURL - CommandLine|contains|all: - url.dll - OpenURLA - CommandLine|contains|all: - url.dll - FileProtocolHandler - CommandLine|contains|all: - zipfldr.dll - RouteTheCall - CommandLine|contains|all: - shell32.dll - Control_RunDLL - CommandLine|contains|all: - shell32.dll - ShellExec_RunDLL - CommandLine|contains|all: - mshtml.dll - PrintHTML - CommandLine|contains|all: - advpack.dll - LaunchINFSection - CommandLine|contains|all: - advpack.dll - RegisterOCX - CommandLine|contains|all: - ieadvpack.dll - LaunchINFSection - CommandLine|contains|all: - ieadvpack.dll - RegisterOCX - CommandLine|contains|all: - ieframe.dll - OpenURL - CommandLine|contains|all: - shdocvw.dll - OpenURL - CommandLine|contains|all: - syssetup.dll - SetupInfObjectInstallAction - CommandLine|contains|all: - setupapi.dll - InstallHinfSection - CommandLine|contains|all: - pcwutl.dll - LaunchApplication - CommandLine|contains|all: - dfshim.dll - ShOpenVerbApplication - CommandLine|contains|all: - dfshim.dll - ShOpenVerbShortcut - CommandLine|contains|all: - scrobj.dll - GenerateTypeLib - http - CommandLine|contains|all: - shimgvw.dll - ImageView_Fullscreen - http - CommandLine|contains|all: - comsvcs.dll - MiniDump filter_main_screensaver: CommandLine|contains: shell32.dll,Control_RunDLL desk.cpl,screensaver,@screensaver filter_main_parent_cpl: ParentImage: C:\Windows\System32\control.exe ParentCommandLine|contains: .cpl CommandLine|contains|all: - Shell32.dll - Control_RunDLL - .cpl filter_main_startmenu: ParentImage:
Near-miss passage: Sigma rule: Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside nor. Logsource: windows / appxdeployment-server. Rule: title: Windows AppX Deployment Full Trust Package Installation id: e54279c7-4910-4e2c-902c-c56a25b549f6 status: experimental description: Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions references: - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-03 tags: - attack.execution - attack.defense-impairment - attack.t1204.002 - attack.t1553.005 logsource: product: windows service: appxdeployment-server detection: selection: EventID: 400 HasFullTrust: true filter_main_legitpath: PackageSourceUri|startswith: - file:///C:/Program%20Files/ - file:///C:/Program%20Files%20(x86)/ filter_main_microsoft: - PackageSourceUri|startswith: https://go.microsoft.com/fwlink/?linkid - PackageSourceUri|contains: - .cdn.microsoft.com - .cdn.office.net/ filter_main_callerprocess: CallingProcess|startswith: - sysprep.exe - svchost.exe,AppReadiness filter_optional_x_update: PackageSourceUri|startswith: x-windowsupdate:// filter_optional_microsoftclient: PackageFullName|startswith: MicrosoftWindows.Client. condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Some legitimate applications installation which have been missed from filtering can generate fps, thus baselining and tuning is recommended before deploying to production level: medium