Rasautou.exe DLL Execution on Windows via -d and -p Parameters

title: Rasautou.exe DLL Execution on Windows via -d and -p Parameters
id: 3c126269-241b-49e0-befd-bb3bab3ca9c7
status: test
description: This rule identifies execution of Rasautou.exe (originally Rasdlui.exe) with command-line options that load an arbitrary DLL (-d) and specify an export to run (-p). Attackers can use this signed binary execution path to run code from a chosen DLL while blending in with legitimate Windows tooling behavior. The detection relies on process creation telemetry that includes the executable path/name and full command line arguments.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Rasautou/
  - https://github.com/fireeye/DueDLLigence
  - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml
author: Julia Fomina, oscd.community, Huntrule Team
date: 2020-10-09
tags:
  - attack.stealth
  - attack.t1218
logsource:
  product: windows
  category: process_creation
  definition: Since options '-d' and '-p' were removed in Windows 10 this rule is relevant only for Windows before 10. And as Windows 7 doesn't log command line in 4688 by default, to detect this attack you need Sysmon 1 configured or KB3004375 installed for command-line auditing (https://support.microsoft.com/en-au/help/3004375/microsoft-security-advisory-update-to-improve-windows-command-line-aud)
detection:
  selection_img:
    - Image|endswith: \rasautou.exe
    - OriginalFileName: rasdlui.exe
  selection_cli:
    CommandLine|contains|all:
      - " -d "
      - " -p "
  condition: all of selection*
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: cd3d1298-eb3b-476c-ac67-12847de55813
    type: derived