Try in Splunk Security Cloud

Description

The following analytic identifies Regsvr32.exe utilizing the silent switch to load DLLs. This technique has most recently been seen in IcedID campaigns to load its initial dll that will download the 2nd stage loader that will download and decrypt the config payload. The switch type may be either a hyphen - or forward slash /. This behavior is typically found with -s, and it is possible there are more switch types that may be used. \ During triage, review parallel processes and capture any artifacts that may have landed on disk. Isolate and contain the endpoint as necessary.

  • Type: Anomaly
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • Last Updated: 2021-07-27
  • Author: Teoderick Contreras, Splunk
  • ID: c9ef7dc4-eeaf-11eb-b2b6-acde48001122

ATT&CK

ID Technique Tactic
T1218 Signed Binary Proxy Execution Defense Evasion
T1218.010 Regsvr32 Defense Evasion

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| where match(process,"(?i)[\-
|\/][Ss]{1}") 
| `regsvr32_with_known_silent_switch_cmdline_filter`

Associated Analytic Story

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.

Required field

  • _time
  • Processes.dest
  • Processes.user
  • Processes.parent_process_name
  • Processes.parent_process
  • Processes.original_file_name
  • Processes.process_name
  • Processes.process
  • Processes.process_id
  • Processes.parent_process_path
  • Processes.process_path
  • Processes.parent_process_id

Kill Chain Phase

  • Exploitation

Known False Positives

minimal. but network operator can use this application to load dll.

RBA

Risk Score Impact Confidence Message
56.0 70 80 An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent parameter.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2