LoFP LoFP / microsoft windows installers leveraging rundll32 for installation.

Techniques

Sample rules

Command Shell Activity Started via RunDLL32

Description

Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code.

Detection logic

process where host.os.type == "windows" and event.type == "start" and
 process.name : ("cmd.exe", "powershell.exe") and
  process.parent.name : "rundll32.exe" and process.parent.command_line != null and
  /* common FPs can be added here */
  not process.parent.args : ("C:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL",
                             "C:\\WINDOWS\\*.tmp,zzzzInvokeManagedCustomActionOutOfProc")