GuLoader Activity: Injected Browser Parent Spawns rundll32.exe on Windows

title: "GuLoader Activity: Injected Browser Parent Spawns rundll32.exe on Windows"
id: 5a500cb2-963a-41ed-9997-ec343142521e
status: test
description: This rule matches process creation where the parent process is a browser executable (chrome.exe, firefox.exe, or msedge.exe) and the child is rundll32.exe. It also requires that the child process command line ends with rundll32.exe, indicating a rundll32 execution initiated from an injected browser process. This behavior matters because it can reflect stealthy malware activity that uses a legitimate browser context to launch a signed Windows utility. The detection relies on Windows process creation telemetry, specifically parent/child process image paths and command-line data.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/GuLoader/proc_creation_win_malware_guloader_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2023-08-07
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \chrome.exe
      - \firefox.exe
      - \msedge.exe
    Image|endswith: \rundll32.exe
    CommandLine|endswith: \rundll32.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 89e1490f-1a3e-452a-bbb8-b68a5f58072f
    type: derived