Windows Process Creation: Command Line Used for SolidPDFCreator DLL Copy and Run-Keys

title: "Windows Process Creation: Command Line Used for SolidPDFCreator DLL Copy and Run-Keys"
id: 8411caf5-1ddd-4f54-8947-a5bb86222801
status: test
description: This rule identifies Windows command-line activity consistent with copying SolidPDFCreator.dll from a public library path and creating persistence via a Run registry entry containing the "SolidPDF" value. Such behavior matters because it combines DLL placement with automatic execution on the next user session. Detection relies on process creation telemetry and the command line strings matching both the DLL copy and registry Run-path patterns.
references:
  - https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Mustang-Panda-Australia-Campaign/proc_creation_win_apt_mustang_panda_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
tags:
  - attack.execution
  - attack.g0129
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    CommandLine|contains|all:
      - copy SolidPDFCreator.dll
      - C:\Users\Public\Libraries\PhotoTvRHD\SolidPDFCreator.dll
  selection_2:
    CommandLine|contains|all:
      - "reg "
      - \Windows\CurrentVersion\Run
      - SolidPDF
      - C:\Users\Public\Libraries\PhotoTvRHD\
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 7806bb49-f653-48d3-a915-5115c1a85234
    type: derived