Windows: Detect Rundll32 launching NSIS module via nsis_uns

title: "Windows: Detect Rundll32 launching NSIS module via nsis_uns"
id: 95b9b4c4-e7d5-4338-ac81-36395194e3ed
status: test
description: This rule flags process creation where rundll32.exe is used with a command line that includes an NSIS-related module marker (nsis_uns) and an export function string (PrintUIEntry). This matters because rundll32 can be leveraged to hide malicious payload execution by proxying module loading rather than directly running the final binary. Telemetry relies on Windows process creation fields including OriginalFileName, the image path, and the full command line.
references:
  - https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88
  - https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/
  - https://www.joesandbox.com/analysis/790122/0/html
  - https://twitter.com/anfam17/status/1607477672057208835
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Rhadamanthys/proc_creation_win_malware_rhadamanthys_stealer_dll_launch.yml
author: TropChaud, Huntrule Team
date: 2023-01-26
modified: 2023-02-05
tags:
  - attack.stealth
  - attack.t1218.011
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_rundll32:
    - OriginalFileName: RUNDLL32.EXE
    - Image|endswith: \rundll32.exe
  selection_dll:
    CommandLine|contains: nsis_uns
  selection_export_function:
    CommandLine|contains: PrintUIEntry
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 5cdbc2e8-86dd-43df-9a1a-200d4745fba5
    type: derived