splunk-security_content/docs/_stories/suspicious_rundll32_activity.md

title, last_modified_at, toc, toc_label, tags

title	last_modified_at	toc	toc_label	tags
Suspicious Rundll32 Activity	2021-02-03	true		Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint Actions on Objectives Exploitation Installation

Try in Splunk Security Cloud{: .btn .btn--success}

Description

Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code.

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2021-02-03
• Author: Michael Haag, Splunk
• ID: 80a65487-854b-42f1-80a1-935e4c170694

Narrative

One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code.

Detections

Name	Technique	Type
Suspicious Rundll32 Rename	System Binary Proxy Execution, Masquerading, Rundll32, Rename System Utilities	Hunting
Detect Rundll32 Application Control Bypass - advpack	System Binary Proxy Execution, Rundll32	TTP
Detect Rundll32 Application Control Bypass - setupapi	System Binary Proxy Execution, Rundll32	TTP
Detect Rundll32 Application Control Bypass - syssetup	System Binary Proxy Execution, Rundll32	TTP
Dump LSASS via comsvcs DLL	LSASS Memory, OS Credential Dumping	TTP
Rundll32 Control RunDLL Hunt	System Binary Proxy Execution, Rundll32	Hunting
Rundll32 Control RunDLL World Writable Directory	System Binary Proxy Execution, Rundll32	TTP
Rundll32 with no Command Line Arguments with Network	System Binary Proxy Execution, Rundll32	TTP
RunDLL Loading DLL By Ordinal	System Binary Proxy Execution, Rundll32	TTP
Suspicious Rundll32 dllregisterserver	System Binary Proxy Execution, Rundll32	TTP
Suspicious Rundll32 StartW	System Binary Proxy Execution, Rundll32	TTP
Suspicious Rundll32 no Command Line Arguments	System Binary Proxy Execution, Rundll32	TTP

Reference

• https://attack.mitre.org/techniques/T1218/011/
• https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
• https://lolbas-project.github.io/lolbas/Binaries/Rundll32

source | version: 1