detection.wiki

Detection rules › Sigma

Suspicious Usage Of ShellExec_RunDLL

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack

MITRE ATT&CK coverage

TacticTechniques
StealthNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Suspicious Usage Of ShellExec_RunDLL
id: d87bd452-6da1-456e-8155-7dc988157b7d
related:
    - id: 36c5146c-d127-4f85-8e21-01bf62355d5a
      type: obsolete
    - id: 8823e85d-31d8-473e-b7f4-92da070f0fc6
      type: similar
status: test
description: Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack
references:
    - https://redcanary.com/blog/raspberry-robin/
    - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
    - https://github.com/SigmaHQ/sigma/issues/1009
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-01
modified: 2022-12-30
tags:
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection_openasrundll:
        CommandLine|contains: 'ShellExec_RunDLL'
    selection_suspcli:
        CommandLine|contains:
            # Note: The ordinal number may differ depending on the DLL version
            - '\Desktop\'
            - '\Temp\'
            - '\Users\Public\'
            - 'comspec'
            - 'iex'
            - 'Invoke-'
            - 'msiexec'
            - 'odbcconf'
            - 'regsvr32'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_openasrundll

selection_openasrundll:
    CommandLine|contains: 'ShellExec_RunDLL'

Stage 2: selection_suspcli

selection_suspcli:
    CommandLine|contains:
        - '\Desktop\'
        - '\Temp\'
        - '\Users\Public\'
        - 'comspec'
        - 'iex'
        - 'Invoke-'
        - 'msiexec'
        - 'odbcconf'
        - 'regsvr32'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • Invoke- corpus 6 (sigma 6)
  • ShellExec_RunDLL corpus 3 (sigma 3)
  • \Desktop\ corpus 13 (sigma 13)
  • \Temp\ corpus 5 (sigma 5)
  • \Users\Public\ corpus 17 (sigma 17)
  • comspec
  • iex corpus 6 (sigma 5, splunk 1)
  • msiexec corpus 5 (sigma 5)
  • odbcconf
  • regsvr32 corpus 15 (sigma 15)