Unusual Child Processes Of SndVol.exe (via process_creation)

title: Unusual Child Processes Of SndVol.exe (via process_creation)
id: c06b56e5-32f2-5f83-bac1-1a3eed974a0c
status: stable
description: This rule detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer)
references:
    - https://twitter.com/Max_Mal_/status/1661322732456353792
author: Huntrule Team
date: 2026-05-21
tags:
    - attack.execution
    - attack.defense-evasion
    - attack.t1218
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\SndVol.exe'
    filter_main_rundll32:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains: ' shell32.dll,Control_RunDLL '
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium