Detectionmediumtest

Suspicious Rundll32 Setupapi.dll Activity

setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Konstantin Grishchenko, oscd.communityCreated Wed Oct 07Updated Sat Nov 27285b85b1-a555-4095-8652-a8a4106af63fwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith: '\runonce.exe'
        ParentImage|endswith: '\rundll32.exe'
        ParentCommandLine|contains|all:
            - 'setupapi.dll'
            - 'InstallHinfSection'
    condition: selection