Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events)

Severity: medium
Time window: 1d
Author: Yuval Naor
Source: github.com/Azure/Azure-Sentinel

This query idenifies when rundll32.exe executes a specific set of inline VBScript commands References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ To use this analytics rule, make sure you have deployed the ASIM normalization parsers

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1547` Boot or Logon Autostart Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Sysmon	Event ID 5: Process terminated
Security-Auditing	Event ID 4688: A new process has been created.
Security-Auditing	Event ID 4689: A process has exited.

Rule body

id: bdf04f58-242b-4729-b376-577c4bdf5d3a
name: Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events)
description: |
  'This query idenifies when rundll32.exe executes a specific set of inline VBScript commands
  References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
  To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
severity: Medium
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
relevantTechniques:
  - T1547
tags:
  - Id: d82e1987-4356-4a7b-bc5e-064f29b143c0
    version: 1.0.0
  - Schema: ASIMProcessEvent
    SchemaVersion: 0.1.0
  - Midnight Blizzard

query: |
  imProcessCreate
  | where Process hassuffix 'rundll32.exe'
  | where CommandLine  has_any ('Execute','RegRead','window.close')
  | project TimeGenerated, Dvc, User, Process, CommandLine, ActingProcessName, EventVendor, EventProduct
  | extend AccountName = tostring(split(User, @'\')[1]), AccountNTDomain = tostring(split(User, @'\')[0])
  | extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)
  | project-away DomainIndex
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: User
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountNTDomain
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Dvc
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
version: 1.1.6
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Yuval Naor
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Protection" ]

Stages and Predicates

Stage 1: `source`

imProcessCreate

Stage 2: `where`

| where Process hassuffix 'rundll32.exe'

Stage 3: `where`

| where CommandLine  has_any ('Execute','RegRead','window.close')

Stage 4: `project`

| project TimeGenerated, Dvc, User, Process, CommandLine, ActingProcessName, EventVendor, EventProduct

Stage 5: `extend` (3 consecutive steps)

| extend AccountName = tostring(split(User, @'\')[1]), AccountNTDomain = tostring(split(User, @'\')[0])
| extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)

Stage 6: `project-away`

| project-away DomainIndex

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`Execute` transforms: `term` corpus 5 (kusto 3, sigma 2) `RegRead` transforms: `term` corpus 5 (kusto 3, sigma 2) `window.close` transforms: `term` corpus 5 (kusto 3, sigma 2)	`field:"CommandLine" kind:match`
`Process`	ends_with	`rundll32.exe`	`field:"Process" kind:ends_with value:"rundll32.exe"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActingProcessName`	`project`
`CommandLine`	`project`
`Dvc`	`project`
`EventProduct`	`project`
`EventVendor`	`project`
`Process`	`project`
`TimeGenerated`	`project`
`User`	`project`
`AccountNTDomain`	`extend`
`AccountName`	`extend`
`HostName`	`extend`
`HostNameDomain`	`extend`

Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events)

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: project

Stage 5: extend (3 consecutive steps)

Stage 6: project-away