Windows LOLBIN Execution From Abnormal Drive (calc, certutil, mshta, regsvr32, rundll32)

Flags Windows LOLBIN execution when process CurrentDirectory is not empty/null and contains C:\, indicating unusual launch context.

FreeUnreviewedSigmamediumv1

windows-lolbin-execution-from-abnormal-drive-calc-certutil-mshta-regsvr32-rundll-d4ca7c59

title: Windows LOLBIN Execution From Abnormal Drive (calc, certutil, mshta, regsvr32, rundll32)
id: 11e1642f-db08-49c2-a915-a8eae0d895b2
related:
  - id: 5b80cf53-3a46-4adc-960b-05ec19348d74
    type: similar
  - id: d4ca7c59-e9e4-42d8-bf57-91a776efcb87
    type: derived
status: test
description: This rule identifies execution of common Windows LOLBINs (such as calc.exe, certutil.exe, cmstp.exe, cscript.exe, installutil.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe) when their CurrentDirectory is set to an abnormal value. Attackers often use trusted binaries launched from unexpected locations (e.g., mounted media or nonstandard working directories) to hide or blend in. The detection relies on process creation telemetry including Image, OriginalFileName, and CurrentDirectory fields.
references:
  - https://thedfirreport.com/2021/12/13/diavol-ransomware/
  - https://www.scythe.io/library/threat-emulation-qakbot
  - https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_lolbin_exec_from_non_c_drive.yml
author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Angelo Violetti - SEC Consult '@angelo_violetti', Aaron Herman, Huntrule Team
date: 2022-01-25
modified: 2023-08-29
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - \calc.exe
        - \certutil.exe
        - \cmstp.exe
        - \cscript.exe
        - \installutil.exe
        - \mshta.exe
        - \regsvr32.exe
        - \rundll32.exe
        - \wscript.exe
    - OriginalFileName:
        - CALC.EXE
        - CertUtil.exe
        - CMSTP.EXE
        - cscript.exe
        - installutil.exe
        - MSHTA.EXE
        - REGSVR32.EXE
        - RUNDLL32.EXE
        - wscript.exe
  filter_main_currentdirectory:
    CurrentDirectory|contains: C:\
  filter_main_empty:
    CurrentDirectory: ""
  filter_main_null:
    CurrentDirectory: null
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Rare false positives could occur on servers with multiple drives.
level: medium
license: DRL-1.1

What it detects

This rule identifies execution of common Windows LOLBINs (such as calc.exe, certutil.exe, cmstp.exe, cscript.exe, installutil.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe) when their CurrentDirectory is set to an abnormal value. Attackers often use trusted binaries launched from unexpected locations (e.g., mounted media or nonstandard working directories) to hide or blend in. The detection relies on process creation telemetry including Image, OriginalFileName, and CurrentDirectory fields.

Known false positives

Rare false positives could occur on servers with multiple drives.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.