Windows rundll32 Cleanup Export Execution via msupdate Service Host (ColdSteel)

title: Windows rundll32 Cleanup Export Execution via msupdate Service Host (ColdSteel)
id: 83251de3-39b4-485a-9751-74747d5734ee
status: test
description: This rule matches process creation where rundll32.exe is launched with a command line containing ColdSteel cleanup export-related function names, and its parent is a svchost.exe instance started with service keys such as msupdate and msupdate2. Attackers can use rundll32 with exported functions to trigger cleanup behavior while blending into legitimate Windows service hosting. The detection relies on process creation telemetry capturing parent image/command line and the child Image and CommandLine contents.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/proc_creation_win_malware_coldsteel_cleanup.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-30
tags:
  - attack.persistence
  - detection.emerging-threats
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \svchost.exe
    ParentCommandLine|contains:
      - " -k msupdate"
      - " -k msupdate2"
      - " -k alg"
    Image|endswith: \rundll32.exe
    CommandLine|contains:
      - UpdateDriverForPlugAndPlayDevicesW
      - ServiceMain
      - DiUninstallDevice
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 88516f06-ebe0-47ad-858e-ae9fd060ddea
    type: derived