Windows Process Creation: SolidPDFCreator.dll Copy and Run Key Persistence Indicators

title: "Windows Process Creation: SolidPDFCreator.dll Copy and Run Key Persistence Indicators"
id: 8411caf5-1ddd-4f54-8947-a5bb86222801
status: test
description: This rule identifies Windows command-line activity that copies a SolidPDFCreator.dll from a specific path and then writes a registry Run key entry containing “SolidPDF” and that same library path. Such behavior is consistent with initial staging and persistence mechanisms used during targeted intrusions. It relies on process creation telemetry with command-line fields to match the exact command fragments present in the observed execution chain.
references:
  - https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Mustang-Panda-Australia-Campaign/proc_creation_win_apt_mustang_panda_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
tags:
  - attack.execution
  - attack.g0129
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    CommandLine|contains|all:
      - copy SolidPDFCreator.dll
      - C:\Users\Public\Libraries\PhotoTvRHD\SolidPDFCreator.dll
  selection_2:
    CommandLine|contains|all:
      - "reg "
      - \Windows\CurrentVersion\Run
      - SolidPDF
      - C:\Users\Public\Libraries\PhotoTvRHD\
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 7806bb49-f653-48d3-a915-5115c1a85234
    type: derived