huntrule

Windows: Uncommon Child Processes Spawned by SndVol.exe

Alerts when SndVol.exe launches unusual child processes, using Windows process creation logs.

FreeUnreviewedSigmamediumv1
title: "Windows: Uncommon Child Processes Spawned by SndVol.exe"
id: 04694a9a-b68a-47fe-8353-3fbb009d3156
status: test
description: This rule flags process creation events where SndVol.exe spawns a child process that is not part of the explicitly allowed rundll32 control-run pattern. Attackers can abuse commonly trusted Windows binaries like the volume mixer to launch additional payloads while blending into normal user activity. The detection relies on Windows process creation telemetry, matching the parent process executable name and inspecting the spawned child executable and command line.
references:
  - https://twitter.com/Max_Mal_/status/1661322732456353792
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sndvol_susp_child_processes.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-09
tags:
  - attack.execution
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \SndVol.exe
  filter_main_rundll32:
    Image|endswith: \rundll32.exe
    CommandLine|contains: " shell32.dll,Control_RunDLL "
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ba42babc-0666-4393-a4f7-ceaf5a69191e
    type: derived

What it detects

This rule flags process creation events where SndVol.exe spawns a child process that is not part of the explicitly allowed rundll32 control-run pattern. Attackers can abuse commonly trusted Windows binaries like the volume mixer to launch additional payloads while blending into normal user activity. The detection relies on Windows process creation telemetry, matching the parent process executable name and inspecting the spawned child executable and command line.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.