huntrule

Windows Process Creation: rundll32.exe launching wermgr.exe via DllRegisterServer

Flags rundll32.exe spawning wermgr.exe where rundll32 command line includes DllRegisterServer.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: rundll32.exe launching wermgr.exe via DllRegisterServer"
id: 2263874e-6ac3-4a3c-8c0d-0982d0977061
related:
  - id: c37510b8-2107-4b78-aa32-72f251e7a844
    type: similar
  - id: 58bf96d9-ff5f-44bd-8dcc-1c4f79bf3a27
    type: derived
status: stable
description: This rule identifies a specific process-tree relationship where rundll32.exe spawns wermgr.exe, with the rundll32 command line containing DllRegisterServer. Attackers and malware commonly use living-off-the-land binaries like rundll32 to register and execute additional components under the appearance of legitimate system activity. The detection relies on Windows process creation telemetry capturing the parent/child images and the parent command line.
references:
  - https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20
  - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Trickbot/proc_creation_win_malware_trickbot_wermgr.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-11-26
modified: 2021-11-27
tags:
  - attack.execution
  - attack.t1559
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \wermgr.exe
    ParentImage|endswith: \rundll32.exe
    ParentCommandLine|contains: DllRegisterServer
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies a specific process-tree relationship where rundll32.exe spawns wermgr.exe, with the rundll32 command line containing DllRegisterServer. Attackers and malware commonly use living-off-the-land binaries like rundll32 to register and execute additional components under the appearance of legitimate system activity. The detection relies on Windows process creation telemetry capturing the parent/child images and the parent command line.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.