mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
mhaag-spl
65 lines
2.0 KiB
YAML
65 lines
2.0 KiB
YAML
name: Rundll32 DNSQuery
|
|
id: f1483f5e-ee29-11eb-9d23-acde48001122
|
|
version: 2
|
|
date: '2022-02-18'
|
|
author: Teoderick Contreras, Splunk
|
|
type: TTP
|
|
datamodel:
|
|
- Endpoint
|
|
description: This search is to detect a suspicious rundll32.exe process having a http
|
|
connection and do a dns query in some web domain. This technique was seen in IcedID
|
|
malware where the rundll32 that execute its payload will contact amazon.com to check
|
|
internet connect and to communicate to its C&C server to download config and other
|
|
file component.
|
|
search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time)
|
|
as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId Computer
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the process name and eventcode = 22 dnsquery executions from your endpoints.
|
|
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
|
Tune and filter known instances where renamed rundll32.exe may be used.
|
|
known_false_positives: unknown
|
|
references:
|
|
- https://any.run/malware-trends/icedid
|
|
tags:
|
|
analytic_story:
|
|
- IcedID
|
|
- Living Off The Land
|
|
confidence: 80
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Defense Evasion
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
|
|
impact: 70
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: rundll32 process $process_name$ having a dns query to $QueryName$ in host
|
|
$Computer$
|
|
mitre_attack_id:
|
|
- T1218
|
|
- T1218.011
|
|
observable:
|
|
- name: Computer
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Attacker
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Image
|
|
- QueryName
|
|
- QueryStatus
|
|
- ProcessId
|
|
- Computer
|
|
risk_score: 56
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|