Try in Splunk Security Cloud

Description

The following analytic identifies rundll32.exe executing a DLL function name, Start and StartW, on the command line that is commonly observed with Cobalt Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of Cobalt Strike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not.

  • Type: TTP
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • Last Updated: 2021-02-04
  • Author: Michael Haag, Splunk
  • ID: 9319dda5-73f2-4d43-a85a-67ce961bddb7

ATT&CK

ID Technique Tactic
T1218 Signed Binary Proxy Execution Defense Evasion
T1218.011 Rundll32 Defense Evasion

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*start* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `suspicious_rundll32_startw_filter`

Associated Analytic Story

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.

Required field

  • _time
  • Processes.dest
  • Processes.user
  • Processes.parent_process_name
  • Processes.parent_process
  • Processes.original_file_name
  • Processes.process_name
  • Processes.process
  • Processes.process_id
  • Processes.parent_process_path
  • Processes.process_path
  • Processes.parent_process_id

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed.

RBA

Risk Score Impact Confidence Message
35.0 70 50 rundll32.exe running with suspicious parameters on $dest$

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 3