Rundll32 Suspicious Command Line (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Threat actors using Gamarue, also referred to as Andromeda or Wauchos, have been observed abusing rundll32.exe using unusual strings for DLL names. This use case detects rundll32 executions with strings matching unusual patterns

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218.011` System Binary Proxy Execution: Rundll32

References

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '27224.49777'
title: Rundll32 Suspicious Command Line
description: Threat actors using Gamarue, also referred to as Andromeda or Wauchos,
  have been observed abusing rundll32.exe using unusual strings for DLL names. This
  use case detects rundll32 executions with strings matching unusual patterns. Living
  Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") TERM(rundll32) OR "rundll32" | regex process="\x5c\x5c?[-_]{2,}[-_]{2,}[-_]{2,}.+,"|
  table _time, host, user, process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- PowerShell logs
references:
- https://redcanary.com/threat-detection-report/threats/gamarue/
- https://redcanary.com/blog/lolbins-abuse/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR "<EventID>4104<") TERM(rundll32) OR "rundll32"

Stage 2: `regex`

| regex process="\x5c\x5c?[-_]{2,}[-_]{2,}[-_]{2,}.+,"

Stage 3: `table`

| table _time, host, user, process, process_*, parent_process_*

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq value:"4104"`
`process`	regex_match	`"\x5c\x5c?[-_]{2,}[-_]{2,}[-_]{2,}.+,"` corpus 3 (splunk 3)	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4104<"`
1	`rundll32`
1	`"rundll32"`