Uncommon Child Processes Of SndVol.exe

 1title: Uncommon Child Processes Of SndVol.exe
 2id: ba42babc-0666-4393-a4f7-ceaf5a69191e
 3status: test
 4description: Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer)
 5references:
 6    - https://twitter.com/Max_Mal_/status/1661322732456353792
 7author: X__Junior (Nextron Systems)
 8date: 2023/06/09
 9tags:
10    - attack.execution
11logsource:
12    product: windows
13    category: process_creation
14detection:
15    selection:
16        ParentImage|endswith: '\SndVol.exe'
17    filter_main_rundll32:
18        Image|endswith: '\rundll32.exe'
19        CommandLine|contains: ' shell32.dll,Control_RunDLL '
20    condition: selection and not 1 of filter_main_*
21falsepositives:
22    - Unknown
23level: medium

References

• Something went wrong, but don’t fret — let’s give it another shot.

  
  Read More

Related rules

• Cscript/Wscript Uncommon Script Extension Execution
• File With Uncommon Extension Created By An Office Application
• Insecure Transfer Via Curl.EXE
• Named Pipe Created Via Mkfifo
• New Virtual Smart Card Created Via TpmVscMgr.EXE