Windows: Uncommon Child Processes Spawned by SndVol.exe
Alerts when SndVol.exe launches unusual child processes, using Windows process creation logs.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-09
- Updated
- 2026-07-30
What it detects
This rule flags process creation events where SndVol.exe spawns a child process that is not part of the explicitly allowed rundll32 control-run pattern. Attackers can abuse commonly trusted Windows binaries like the volume mixer to launch additional payloads while blending into normal user activity. The detection relies on Windows process creation telemetry, matching the parent process executable name and inspecting the spawned child executable and command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-uncommon-child-processes-spawned-by-sndvol-exe-ba42babc
title: "Windows: Uncommon Child Processes Spawned by SndVol.exe"
id: 04694a9a-b68a-47fe-8353-3fbb009d3156
status: test
description: This rule flags process creation events where SndVol.exe spawns a child process that is not part of the explicitly allowed rundll32 control-run pattern. Attackers can abuse commonly trusted Windows binaries like the volume mixer to launch additional payloads while blending into normal user activity. The detection relies on Windows process creation telemetry, matching the parent process executable name and inspecting the spawned child executable and command line.
references:
- https://twitter.com/Max_Mal_/status/1661322732456353792
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sndvol_susp_child_processes.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-09
tags:
- attack.execution
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith: \SndVol.exe
filter_main_rundll32:
Image|endswith: \rundll32.exe
CommandLine|contains: " shell32.dll,Control_RunDLL "
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: ba42babc-0666-4393-a4f7-ceaf5a69191e
type: derived