Windows Process Creation: Suspicious Dridex-Linked svchost and regsvr32 Execution Patterns

title: "Windows Process Creation: Suspicious Dridex-Linked svchost and regsvr32 Execution Patterns"
id: 9bceff19-51a0-4ff4-a496-b3c200ec67e5
status: stable
description: This rule flags Windows process creation events that match specific execution patterns involving svchost.exe and regsvr32.exe, including unusual parent/child relationships and command-line arguments that suggest discovery activity. Such behavior matters because malware and related loaders may use trusted Windows processes to run payload components from user-accessible paths and to perform system enumeration. Telemetry relies on process creation logs including Image, CommandLine, and ParentImage fields to identify the matching process chains and argument markers.
references:
  - https://app.any.run/tasks/993daa5e-112a-4ff6-8b5a-edbcec7c7ba3
  - https://redcanary.com/threat-detection-report/threats/dridex/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Dridex/proc_creation_win_malware_dridex.yml
author: Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-01-10
modified: 2023-02-03
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - attack.discovery
  - attack.t1135
  - attack.t1033
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_svchost:
    Image|endswith: \svchost.exe
    CommandLine|contains|all:
      - C:\Users\
      - \Desktop\
  filter_svchost:
    ParentImage|startswith: C:\Windows\System32\
  selection_regsvr:
    ParentImage|endswith: \excel.exe
    Image|endswith: \regsvr32.exe
    CommandLine|contains:
      - " -s "
      - \AppData\Local\Temp\
  filter_regsvr:
    CommandLine|contains: .dll
  selection_anomaly_parent:
    ParentImage|endswith: \svchost.exe
  selection_anomaly_child_1:
    Image|endswith: \whoami.exe
    CommandLine|contains: " /all"
  selection_anomaly_child_2:
    Image|endswith:
      - \net.exe
      - \net1.exe
    CommandLine|contains: " view"
  condition: (selection_svchost and not filter_svchost) or (selection_regsvr and not filter_regsvr) or (selection_anomaly_parent and 1 of selection_anomaly_child_*)
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: e6eb5a96-9e6f-4a18-9cdd-642cfda21c8e
    type: derived