Command Shell Activity Started via RunDLL32
Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/10/19"
3integration = ["endpoint", "windows"]
4maturity = "production"
5updated_date = "2024/05/21"
6
7[rule]
8author = ["Elastic"]
9description = "Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code."
10false_positives = ["Microsoft Windows installers leveraging RunDLL32 for installation."]
11from = "now-9m"
12index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*"]
13language = "eql"
14license = "Elastic License v2"
15name = "Command Shell Activity Started via RunDLL32"
16risk_score = 21
17rule_id = "9ccf3ce0-0057-440a-91f5-870c6ad39093"
18setup = """## Setup
19
20If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
21events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
22Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
23`event.ingested` to @timestamp.
24For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
25"""
26severity = "low"
27tags = [
28 "Domain: Endpoint",
29 "OS: Windows",
30 "Use Case: Threat Detection",
31 "Tactic: Execution",
32 "Tactic: Credential Access",
33 "Tactic: Defense Evasion",
34 "Data Source: Elastic Endgame",
35 "Data Source: Elastic Defend",
36 "Data Source: Sysmon",
37]
38timestamp_override = "event.ingested"
39type = "eql"
40
41query = '''
42process where host.os.type == "windows" and event.type == "start" and
43 process.name : ("cmd.exe", "powershell.exe") and
44 process.parent.name : "rundll32.exe" and process.parent.command_line != null and
45 /* common FPs can be added here */
46 not process.parent.args : ("C:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL",
47 "C:\\WINDOWS\\*.tmp,zzzzInvokeManagedCustomActionOutOfProc")
48'''
49
50
51[[rule.threat]]
52framework = "MITRE ATT&CK"
53[[rule.threat.technique]]
54id = "T1059"
55name = "Command and Scripting Interpreter"
56reference = "https://attack.mitre.org/techniques/T1059/"
57[[rule.threat.technique.subtechnique]]
58id = "T1059.001"
59name = "PowerShell"
60reference = "https://attack.mitre.org/techniques/T1059/001/"
61
62[[rule.threat.technique.subtechnique]]
63id = "T1059.003"
64name = "Windows Command Shell"
65reference = "https://attack.mitre.org/techniques/T1059/003/"
66
67
68
69[rule.threat.tactic]
70id = "TA0002"
71name = "Execution"
72reference = "https://attack.mitre.org/tactics/TA0002/"
73[[rule.threat]]
74framework = "MITRE ATT&CK"
75[[rule.threat.technique]]
76id = "T1552"
77name = "Unsecured Credentials"
78reference = "https://attack.mitre.org/techniques/T1552/"
79
80
81[rule.threat.tactic]
82id = "TA0006"
83name = "Credential Access"
84reference = "https://attack.mitre.org/tactics/TA0006/"
85[[rule.threat]]
86framework = "MITRE ATT&CK"
87[[rule.threat.technique]]
88id = "T1218"
89name = "System Binary Proxy Execution"
90reference = "https://attack.mitre.org/techniques/T1218/"
91[[rule.threat.technique.subtechnique]]
92id = "T1218.011"
93name = "Rundll32"
94reference = "https://attack.mitre.org/techniques/T1218/011/"
95
96
97
98[rule.threat.tactic]
99id = "TA0005"
100name = "Defense Evasion"
101reference = "https://attack.mitre.org/tactics/TA0005/"
Related rules
- Conhost Spawned By Suspicious Parent Process
- Microsoft Build Engine Using an Alternate Name
- Persistence via Hidden Run Key Detected
- Potential DLL Side-Loading via Microsoft Antimalware Service Executable
- Potential DLL Side-Loading via Trusted Microsoft Programs