Anvilogic high experimental other

DLL Execution from Uncommon Process [snowflake-crowdstrikefdr_process]

During an attack using Ursnif malware, threat actors were observed executing DLLs with a renamed rundll32 binary. This use case detects execution of the DLL functions DllRegisterServer, DllMain, DllUnregisterServer, DllInstall, or DllCanUnloadNow from processes other than rundll32.exe. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform ilike '%Win%' and process_path not ilike '%rundll32.exe' and regexp_like(process, '.*,(DllRegisterServer
| DllMain
| DllUnregisterServer
| DllInstall
| DllCanUnloadNow).*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...