Windows Suspicious rasdial.exe Process Execution

Flags Windows process executions of rasdial.exe by matching process image names ending with rasdial.exe.

FreeUnreviewedSigmamediumv1

windows-suspicious-rasdial-exe-process-execution-6bba49bf

title: Windows Suspicious rasdial.exe Process Execution
id: 139ebe63-d92e-4338-9e35-accd63da1c38
status: test
description: This rule identifies process creations where the executable name ends with rasdial.exe. Attackers can use rasdial to initiate or manipulate network dial-up/remote connections, which may support command-and-control or connectivity changes. The detection relies on Windows process creation telemetry that includes the process image name.
references:
  - https://twitter.com/subTee/status/891298217907830785
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rasdial_execution.yml
author: juju4, Huntrule Team
date: 2019-01-16
modified: 2021-11-27
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: rasdial.exe
  condition: selection
falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored environment
level: medium
license: DRL-1.1
related:
  - id: 6bba49bf-7f8c-47d6-a1bb-6b4dece4640e
    type: derived

What it detects

This rule identifies process creations where the executable name ends with rasdial.exe. Attackers can use rasdial to initiate or manipulate network dial-up/remote connections, which may support command-and-control or connectivity changes. The detection relies on Windows process creation telemetry that includes the process image name.

Known false positives

False positives depend on scripts and administrative tools used in the monitored environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.