Uncommon Child Processes Of SndVol.exe
Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer)
Sigma rule (View on GitHub)
1title: Uncommon Child Processes Of SndVol.exe
2id: ba42babc-0666-4393-a4f7-ceaf5a69191e
3status: test
4description: Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer)
5references:
6 - https://twitter.com/Max_Mal_/status/1661322732456353792
7author: X__Junior (Nextron Systems)
8date: 2023-06-09
9tags:
10 - attack.execution
11logsource:
12 product: windows
13 category: process_creation
14detection:
15 selection:
16 ParentImage|endswith: '\SndVol.exe'
17 filter_main_rundll32:
18 Image|endswith: '\rundll32.exe'
19 CommandLine|contains: ' shell32.dll,Control_RunDLL '
20 condition: selection and not 1 of filter_main_*
21falsepositives:
22 - Unknown
23level: medium
References
Related rules
- AADInternals PowerShell Cmdlets Execution - ProccessCreation
- AADInternals PowerShell Cmdlets Execution - PsScript
- AMSI Bypass Pattern Assembly GetType
- APT29 2018 Phishing Campaign CommandLine Indicators
- AWS EC2 Startup Shell Script Change