Try in Splunk Security Cloud

Description

This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable drop it either appdata or programdata as part of its execution.

  • Type: TTP
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • Last Updated: 2021-07-26
  • Author: Teoderick Contreras, Splunk
  • ID: 6338266a-ee2a-11eb-bf68-acde48001122

ATT&CK

ID Technique Tactic
T1218 Signed Binary Proxy Execution Defense Evasion
T1218.011 Rundll32 Defense Evasion
`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe", "*.dll",) 
| stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename ProcessGuid dest user_id 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `rundll32_process_creating_exe_dll_files_filter`

Associated Analytic Story

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and eventcode 11 executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.

Required field

  • _time
  • Image
  • TargetFilename
  • ProcessGuid
  • dest
  • user_id

Kill Chain Phase

  • Exploitation

Known False Positives

unknown

RBA

Risk Score Impact Confidence Message
80.0 80 100 rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1