splunk-security_content/detections/endpoint/suspicious_rundll32_plugininit.yml

name: Suspicious Rundll32 PluginInit
id: 92d51712-ee29-11eb-b1ae-acde48001122
version: 2
date: '2021-07-26'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This search is to detect a suspicious rundll32.exe process with plugininit
  parameter. This technique is commonly seen in IcedID malware to execute its initial
  dll stager to download another payload to the compromised machine.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*PluginInit*
  by  Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name
  Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `suspicious_rundll32_plugininit_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: third party application may used this dll export name to execute
  function.
references:
- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
tags:
  analytic_story:
  - IcedID
  confidence: 70
  context:
  - Source:Endpoint
  - Stage:Defense Evasion
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log
  impact: 60
  kill_chain_phases:
  - Exploitation
  message: rundll32 process $process_name$ with commandline $process$ in host $dest$
  mitre_attack_id:
  - T1218
  - T1218.011
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: process_name
    type: Process
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.dest
  - Processes.user
  - Processes.parent_process_name
  - Processes.parent_process
  - Processes.original_file_name
  - Processes.process_name
  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 42
  security_domain: endpoint
  supported_tas:
  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint