Detection rules › Splunk
Suspicious DLLhost Execution (Windows Event Log)
Used by Windows to DLL Surrogate COM Objects, “dllhost.exe” process has been used by malware in the past (especially trickbot) and can be used to load a registered or hijacked COM Server payload
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1546.015 Event Triggered Execution: Component Object Model Hijacking |
| Privilege Escalation | T1546.015 Event Triggered Execution: Component Object Model Hijacking |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '6176.6729'
title: Suspicious DLLhost Execution
description: 'Used by Windows to DLL Surrogate COM Objects, “dllhost.exe” process
has been used by malware in the past (especially trickbot) and can be used to load
a registered or hijacked COM Server payload. -- Living Off the Land Binary and Scripts
(LOLBAS) (LOLBIN) -- Threat Actor Association: APT29, Wizard Spider - Software Association:
Avaddon, Bazarloader, Blackcat/ALPHV, Conti, Quantum'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) (TERM(dllhost) OR "dllhost.exe") | table _time,
host, user, signature_id, process, process_*, parent_process_* | bin span=1s | stats
values(*) as * by _time, host | eventstats c(process) as c_process by process |
where c_process < 6 AND match(process_name,"(?i)dllhost") '
techniques:
- privilege-escalation:event triggered execution:component object model hijacking
- persistence:event triggered execution:component object model hijacking
technique_id:
- T1546.015
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://lolbas-project.github.io/lolbas/Binaries/Dllhost/
- https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) (TERM(dllhost) OR "dllhost.exe")
Stage 2: table
| table _time, host, user, signature_id, process, process_*, parent_process_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: eventstats
| eventstats c(process) as c_process by process
Stage 6: where
| where c_process < 6 AND match(process_name,"(?i)dllhost")
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
c_process | lt |
|
process_name | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | TERM |
| 1 | dllhost |
| 1 | "dllhost.exe" |