detection.wiki

Detection rules › Sigma

Suspicious Network Connection Binary No CommandLine

Status
test
Severity
high
Log source
product windows, category network_connection
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects suspicious network connections made by a well-known Windows binary run with no command line parameters

MITRE ATT&CK coverage

TacticTechniques
StealthNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 3Network connection

Rule body yaml

title: Suspicious Network Connection Binary No CommandLine
id: 20384606-a124-4fec-acbb-8bd373728613
status: test
description: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters
references:
    - https://redcanary.com/blog/raspberry-robin/
author: Florian Roth (Nextron Systems)
date: 2022-07-03
tags:
    - attack.stealth
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        Image|endswith:
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\dllhost.exe'
        CommandLine|endswith:
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\dllhost.exe'
    filter_no_cmdline:
        CommandLine: ''
    filter_null: # e.g. Sysmon has no CommandLine field in network events with ID 3
        CommandLine: null
    condition: selection and not 1 of filter*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection and not 1 of filter*

Stage 1: selection

selection:
    Initiated: 'true'
    Image|endswith:
        - '\regsvr32.exe'
        - '\rundll32.exe'
        - '\dllhost.exe'
    CommandLine|endswith:
        - '\regsvr32.exe'
        - '\rundll32.exe'
        - '\dllhost.exe'

Stage 2: not filter*

filter_no_cmdline:
    CommandLine: ''
filter_null:
    CommandLine: null

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
CommandLineis_null(no value, null check)

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLineends_with
  • \dllhost.exe
  • \regsvr32.exe
  • \rundll32.exe corpus 3 (sigma 3)
Imageends_with
  • \dllhost.exe corpus 11 (sigma 11)
  • \regsvr32.exe corpus 65 (sigma 65)
  • \rundll32.exe corpus 95 (sigma 95)
Initiatedeq
  • true corpus 50 (sigma 50)