Anvilogic high experimental spl

DLL Execution from Uncommon Process [splunk-powershell]

During an attack using Ursnif malware, threat actors were observed executing DLLs with a renamed rundll32 binary. This use case detects execution of the DLL functions DllRegisterServer, DllMain, DllUnregisterServer, DllInstall, or DllCanUnloadNow from processes other than rundll32.exe. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) 
OR "<EventID>4104<") ",DllRegisterServer" 
OR ",DllMain" 
OR ",DllUnregisterServer" 
OR ",DllInstall" 
OR ",DllCanUnloadNow"
| rex field=process ",(?<dll_function>\S+)"
| where not match(process, "(?i)rundll32")
| table _time, host, user, process, process_*, parent_process*, dll_function
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...