Suspicious DLLhost Execution (PowerShell)

id: '6176.6730'
title: Suspicious DLLhost Execution
description: 'Used by Windows to DLL Surrogate COM Objects, “dllhost.exe” process
  has been used by malware in the past (especially trickbot) and can be used to load
  a registered or hijacked COM Server payload. -- Living Off the Land Binary and Scripts
  (LOLBAS) (LOLBIN) -- Threat Actor Association: APT29, Wizard Spider - Software Association:
  Avaddon, Bazarloader, Blackcat/ALPHV, Conti, Quantum'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<" OR TERM(EventCode=4103) OR "<EventID>4103<") (TERM(dllhost) OR
  "dllhost.exe") | table _time, host, user, signature_id, process | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- privilege-escalation:event triggered execution:component object model hijacking
- persistence:event triggered execution:component object model hijacking
technique_id:
- T1546.015
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://lolbas-project.github.io/lolbas/Binaries/Dllhost/
- https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08