Windows: Identify TAIDOOR RAT DLL load via rundll32 command-line patterns

title: "Windows: Identify TAIDOOR RAT DLL load via rundll32 command-line patterns"
id: f7bced47-ca4a-4f5b-806b-ba8d4971157c
status: test
description: This rule flags suspicious Windows process creation where the command line matches specific TAIDOOR RAT DLL loading patterns, including variants referencing "MyStart" through DLL arguments and execution via rundll32.exe. Attackers may use rundll32 to load malicious DLL exports for stealthy execution without dropping a full standalone payload. Telemetry relies on process creation events with access to the full command line string.
references:
  - https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/TAIDOOR-RAT/proc_creation_win_apt_taidoor.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-30
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1055.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains:
      - dll,MyStart
      - dll MyStart
  selection2a:
    CommandLine|endswith: " MyStart"
  selection2b:
    CommandLine|contains: rundll32.exe
  condition: selection1 or ( selection2a and selection2b )
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d1aa3382-abab-446f-96ea-4de52908210b
    type: derived