Windows Process Creation: -export dll_u or trailing ,dll_u in CommandLine

title: "Windows Process Creation: -export dll_u or trailing ,dll_u in CommandLine"
id: 0c6c6b27-c300-4a59-8735-d03729700f0c
status: stable
description: This rule matches Windows process creation events whose command line includes the string "-export dll_u" or ends with ",dll_u" / " dll_u". Export function loading behavior can be used to direct how a DLL’s exports are handled during execution, which may support stealthy or proxy-like loading patterns. Detection relies on process command-line telemetry, specifically substring and suffix matches in the recorded CommandLine field.
references:
  - https://github.com/00derp/EquationGroupLeak/search?utf8=%E2%9C%93&q=dll_u&type=
  - https://twitter.com/cyb3rops/status/972186477512839170
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/EquationGroup/proc_creation_win_apt_equationgroup_dll_u_load.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-03-04
modified: 2023-03-09
tags:
  - attack.stealth
  - attack.g0020
  - attack.t1218.011
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains: -export dll_u
    - CommandLine|endswith:
        - ",dll_u"
        - " dll_u"
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: d465d1d8-27a2-4cca-9621-a800f37cf72e
    type: derived