huntrule

Windows Process Creation: Suspicious ShellExec_RunDLL Command-Line Usage

Detects Windows command lines containing ShellExec_RunDLL along with other suspicious execution indicators.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: Suspicious ShellExec_RunDLL Command-Line Usage"
id: fea07ae2-4e64-4bf5-a5cb-049eba8f3a65
related:
  - id: 36c5146c-d127-4f85-8e21-01bf62355d5a
    type: obsolete
  - id: 8823e85d-31d8-473e-b7f4-92da070f0fc6
    type: similar
  - id: d87bd452-6da1-456e-8155-7dc988157b7d
    type: derived
status: test
description: This rule flags Windows process creation events where the command line contains ShellExec_RunDLL, indicating an attempt to launch other commands indirectly through Windows shell execution. It also looks for additional suspicious command-line fragments consistent with commonly abused execution paths and tools. The detection relies on process creation telemetry and inspection of the CommandLine field to match these specific string patterns.
references:
  - https://redcanary.com/blog/raspberry-robin/
  - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-01
modified: 2022-12-30
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_openasrundll:
    CommandLine|contains: ShellExec_RunDLL
  selection_suspcli:
    CommandLine|contains:
      - \Desktop\
      - \Temp\
      - \Users\Public\
      - comspec
      - iex
      - Invoke-
      - msiexec
      - odbcconf
      - regsvr32
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the command line contains ShellExec_RunDLL, indicating an attempt to launch other commands indirectly through Windows shell execution. It also looks for additional suspicious command-line fragments consistent with commonly abused execution paths and tools. The detection relies on process creation telemetry and inspection of the CommandLine field to match these specific string patterns.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.