Windows rundll32 Cleanup Export Execution from svchost msupdate Services

title: Windows rundll32 Cleanup Export Execution from svchost msupdate Services
id: 83251de3-39b4-485a-9751-74747d5734ee
status: test
description: This rule identifies process creation where svchost.exe running with msupdate-related service parameters spawns rundll32.exe. The spawned rundll32 command line contains specific exported function names associated with a cleanup sequence. This behavior can indicate abuse of a Windows service host to execute internal module exports, so detecting it helps flag suspicious persistence-driven command execution. Telemetry relies on process creation events including parent image, parent command line, child image, and child command line.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/proc_creation_win_malware_coldsteel_cleanup.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-30
tags:
  - attack.persistence
  - detection.emerging-threats
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \svchost.exe
    ParentCommandLine|contains:
      - " -k msupdate"
      - " -k msupdate2"
      - " -k alg"
    Image|endswith: \rundll32.exe
    CommandLine|contains:
      - UpdateDriverForPlugAndPlayDevicesW
      - ServiceMain
      - DiUninstallDevice
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 88516f06-ebe0-47ad-858e-ae9fd060ddea
    type: derived