LoFP LoFP / limitted. this anomaly behavior is not commonly seen in clean host.

Techniques

Sample rules

Mshta spawning Rundll32 OR Regsvr32 Process

Description

This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload.

Detection logic


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "mshta.exe"  `process_rundll32` OR `process_regsvr32` by  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest 
| `drop_dm_object_name("Processes")` 
| `security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
| `mshta_spawning_rundll32_or_regsvr32_process_filter`