From d53f30cff76dce96825ecae392fc03d93fc00464 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 9 Feb 2021 19:37:50 +0000 Subject: [PATCH] Added detection testing service results inSuspicious Rundll32 dllregisterserver --- .../suspicious_rundll32_dllregisterserver.yml | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index 625e045999..0067f2f862 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -4,9 +4,10 @@ version: 1 date: '2021-02-09' description: The following analytic identifies rundll32.exe using dllregisterserver on the command line to load a DLL. When a DLL is registered, the DllRegisterServer - method entry point in the DLL is invoked. This is typically seen when a DLL is - being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it. - During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. + method entry point in the DLL is invoked. This is typically seen when a DLL is being + registered on the system. Not every instance is considered malicious, but it will + capture malicious use of it. During investigation, review the parent process and + parrellel processes executing. Capture the DLL being loaded and inspect further. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -23,14 +24,13 @@ references: author: Michael Haag, Splunk search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_dllregisterserver_filter`' -known_false_positives: This is likely to produce false positives and will require some filtering. - Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names. +known_false_positives: This is likely to produce false positives and will require + some filtering. Tune the query by adding command line paths to known good DLLs, + or filtering based on parent process names. tags: analytics_story: - Suspicious Rundll32 Activity @@ -46,4 +46,5 @@ tags: security_domain: endpoint asset_type: Endpoint dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + automated_detection_testing: passed