Techniques
Sample rules
Command Shell Activity Started via RunDLL32
- source: elastic
- technicques:
- T1059
- T1218
- T1552
Description
Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code.
Detection logic
process where host.os.type == "windows" and event.type == "start" and
process.name : ("cmd.exe", "powershell.exe") and
process.parent.name : "rundll32.exe" and process.parent.command_line != null and
/* common FPs can be added here */
not process.parent.args : ("C:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL",
"C:\\WINDOWS\\*.tmp,zzzzInvokeManagedCustomActionOutOfProc")