Windows: Cmdl32.EXE executed with /vpn and /lan flags

title: "Windows: Cmdl32.EXE executed with /vpn and /lan flags"
id: 0d2749e5-4cf2-4c01-9e59-43522fab9e34
status: test
description: This rule flags process creation events where cmdl32.exe is executed and the command line contains both /vpn and /lan. This combination can indicate an attempt to use Cmdl32 to retrieve an arbitrary file via a configuration file. Validate the argument-specified file path and contents, and correlate with surrounding process activity to assess whether the download target is suspicious.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/
  - https://twitter.com/SwiftOnSecurity/status/1455897435063074824
  - https://github.com/LOLBAS-Project/LOLBAS/pull/151
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmdl32_arbitrary_file_download.yml
author: frack113, Huntrule Team
date: 2021-11-03
modified: 2024-04-22
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmdl32.exe
    - OriginalFileName: CMDL32.EXE
  selection_cli:
    CommandLine|contains|all:
      - /vpn
      - /lan
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: f37aba28-a9e6-4045-882c-d5004043b337
    type: derived