This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload.
- Type: TTP
- Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Datamodel: Endpoint
- Last Updated: 2021-07-19
- Author: Teoderick Contreras, Splunk
- ID: 4aa5d062-e893-11eb-9eb2-acde48001122
|T1218||Signed Binary Proxy Execution||Defense Evasion|
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "mshta.exe" `process_rundll32` OR `process_regsvr32` by Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter`
Associated Analytic Story
How To Implement
To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the
Endpoint datamodel in the
Processes node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
Kill Chain Phase
Known False Positives
limitted. this anomaly behavior is not commonly seen in clean host.
|56.0||70||80||a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$|
source | version: 2