Windows rundll32 Parent With Select Binary Execution Indicative of Process Hollowing

title: Windows rundll32 Parent With Select Binary Execution Indicative of Process Hollowing
id: f9367be4-f9b4-4bc1-8525-dc2a2478a92f
status: test
description: This rule flags process creation events where rundll32.exe is the parent process and the spawned child image matches specific legitimate Windows binaries. Such a sequence can indicate process hollowing behavior, where attackers start a benign binary to perform stealthy execution. The detection relies on Windows process creation telemetry, matching process image paths and parent/child command-line content, and suppresses a common benign case involving sndvol.exe launched from mmsys.cpl.
references:
  - https://www.virustotal.com/gui/file/b6e8910fb9b3bb1fcddefd35ff0ed8624930d30d6977e11808c8330415685a62
  - https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
  - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_hollowing.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-10-27
modified: 2024-01-26
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.012
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \rundll32.exe
    Image|endswith:
      - \SearchFilterHost.exe
      - \SearchProtocolHost.exe
      - \sndvol.exe
      - \wermgr.exe
      - \wwahost.exe
  filter_main_legit_sndvol:
    Image|endswith: \sndvol.exe
    ParentCommandLine|contains: mmsys.cpl
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: d8937fe7-42d5-4b4d-8178-e089c908f63f
    type: derived