Detection rules › Splunk
Suspicious DLLhost Execution (PowerShell)
Used by Windows to DLL Surrogate COM Objects, “dllhost.exe” process has been used by malware in the past (especially trickbot) and can be used to load a registered or hijacked COM Server payload
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1546.015 Event Triggered Execution: Component Object Model Hijacking |
| Privilege Escalation | T1546.015 Event Triggered Execution: Component Object Model Hijacking |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body yaml
id: '6176.6730'
title: Suspicious DLLhost Execution
description: 'Used by Windows to DLL Surrogate COM Objects, “dllhost.exe” process
has been used by malware in the past (especially trickbot) and can be used to load
a registered or hijacked COM Server payload. -- Living Off the Land Binary and Scripts
(LOLBAS) (LOLBIN) -- Threat Actor Association: APT29, Wizard Spider - Software Association:
Avaddon, Bazarloader, Blackcat/ALPHV, Conti, Quantum'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
"<EventID>4104<" OR TERM(EventCode=4103) OR "<EventID>4103<") (TERM(dllhost) OR
"dllhost.exe") | table _time, host, user, signature_id, process | bin span=1s |
stats values(*) as * by _time, host '
techniques:
- privilege-escalation:event triggered execution:component object model hijacking
- persistence:event triggered execution:component object model hijacking
technique_id:
- T1546.015
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://lolbas-project.github.io/lolbas/Binaries/Dllhost/
- https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR "<EventID>4104<" OR TERM(EventCode=4103) OR "<EventID>4103<") (TERM(dllhost) OR "dllhost.exe")
Stage 2: table
| table _time, host, user, signature_id, process
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4104<" |
| 1 | TERM |
| 1 | "<EventID>4103<" |
| 1 | TERM |
| 1 | dllhost |
| 1 | "dllhost.exe" |