Elastic Defend high stable eql

RunDLL32/Regsvr32 Loads Dropped Executable

Identifies when RunDLL32 or Regsvr32 loads an executable that was dropped by commonly abused programs via phishing such as Microsoft Office or Powershell. An adversary may deliver a weaponized Office document to their target that writes and executes a malicious DLL.

View Source

Detection Logic

sequence with maxspan=1m
  [ file where event.action != "deletion" and
    not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
      process.name :
          ("WINWORD.EXE",
           "EXCEL.EXE",
           "POWERPNT.EXE",
           "MSACCESS.EXE",
           "MSHTA.EXE",
           "wscript.exe",
           "CertUtil.exe",
           "CertReq.exe",
           "Cmd.exe",
           "xcopy.exe",
           "curl.exe",
           "powershell.exe") and
      (
        file.extension : ("dll", "cpl", "ocx") or
        // Match Windows PE files by header data (MZ)
        file.Ext.header_bytes : "4d5a*"
      ) and
  not (file.path : ("?:\\oracle\\x86\\bin\\*", "?:\\oracle\\x64\\bin\\*") and process.name : "xcopy.exe") and
  not (process.name : "cmd.exe" and 
      file.path : ("?:\\PROBAS\\*", "?:\\Windows\\SysWOW64\\*", "?:\\Windows\\System32\\*",  "C:\\Development\\Components\\*.dll"))
  ] as event0
  [ library where process.name : ("rundll32.exe", "regsvr32.exe") and
    stringcontains~(dll.path, event0.file.path) and
    not dll.code_signature.trusted == true and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
    not dll.path : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") and
    not (dll.pe.original_file_name == "RbkVssProvider.dll" and dll.path : "?:\\Windows\\Temp\\rubrik_vmware*\\RbkVssProvider.dll") and
    not dll.pe.imphash : "7ce8b277ed3218e26a4bab54ca4af843" and
    not dll.hash.sha256 in ("2a95cf7d3189920f30bc35b0ca2ee50097d8b9d959582fee913e3f0125feec3b",
                            "3adc5ac350d41a1c29e900089b09d237374fe4e9c8887dbe75d2ba0af982c798",
                            "76985a241b88f74d6962af99c3f9493a1db234e4633271785ab5759cf8de9a5f",
                            "e40828a0802b3bf759978a7b68b9534c55bf57036de1f872ccbce38ad2afa20b",
                            "27912b78125ffcbef3f7239ab394552b1c0d188a0275f691bfaa87e072795bf9") and
    not (process.name : "regsvr32.exe" and dll.path : "C:\\Oracle\\*.dll")]

Field Validations

Loading…

Comments (0)

Loading comments...