Windows Process Discovery Commands Triggered via Rundll32 and Search Host Parent Processes

title: Windows Process Discovery Commands Triggered via Rundll32 and Search Host Parent Processes
id: d90e488a-0639-4413-a104-9737d40eae9c
status: test
description: This rule identifies Windows process creation where a parent process ending in SearchFilterHost.exe or SearchProtocolHost.exe runs commands for system, network, and identity discovery (ipconfig /all, netstat -aon, and whoami /all). The activity is associated with short, automated discovery bursts that can support malware registration and subsequent command-and-control operations. Detection relies on process creation telemetry including GrandParentImage, ParentImage, and full CommandLine.
references:
  - https://www.virustotal.com/gui/file/72f1a5476a845ea02344c9b7edecfe399f64b52409229edaf856fcb9535e3242
  - https://tria.ge/231023-lpw85she57/behavioral2
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_discovery.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-10-27
modified: 2024-01-26
tags:
  - attack.discovery
  - attack.t1016
  - attack.t1049
  - attack.t1087
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
  definition: "Requirements: By default the process_creation type event might not contain the GrandParentImage. Make sure you collect such fields in order to use this rule"
detection:
  selection_parent:
    - GrandParentImage|endswith: \rundll32.exe
    - ParentImage|endswith:
        - \SearchFilterHost.exe
        - \SearchProtocolHost.exe
  selection_child:
    CommandLine:
      - ipconfig.exe /all
      - netstat.exe -aon
      - whoami.exe /all
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 698d4431-514f-4c82-af4d-cf573872a9f5
    type: derived