Emerging Threatcriticaltest

Potential Emotet Rundll32 Execution

Detecting Emotet DLL loading by looking for rundll32.exe processes with command lines ending in ,RunDLL or ,Control_RunDLL

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
FPT.EagleEyeCreated Fri Dec 25Updated Tue Feb 2154e57ce3-0672-46eb-a402-2c0948d5e3e92020
Emerging Threat
Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic4 selectors
detection:
    selection_img:
        - Image|endswith: '\rundll32.exe'
        - OriginalFileName: 'RUNDLL32.EXE'
    selection_cli:
        CommandLine|endswith:
            - ',RunDLL'
            - ',Control_RunDLL'
            # - ',#1'  too generic - function load by ordinal is not Emotet specific
    filter_legitimate_dll:
        CommandLine|endswith:
            - '.dll,Control_RunDLL'
            - '.dll",Control_RunDLL'
            - '.dll'',Control_RunDLL'
    filter_ide:
        ParentImage|endswith: '\tracker.exe' # When Visual Studio compile NodeJS program, it might use MSBuild to create tracker.exe and then, the tracker.exe fork rundll32.exe
    condition: all of selection_* and not 1 of filter_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

MITRE ATT&CK

Sub-techniques

Other

detection.emerging-threats
Rule Metadata
Rule ID
54e57ce3-0672-46eb-a402-2c0948d5e3e9
Status
test
Level
critical
Type
Emerging Threat
Created
Fri Dec 25
Modified
Tue Feb 21
Path
rules-emerging-threats/2020/Malware/Emotet/proc_creation_win_malware_emotet_rundll32_execution.yml
Raw Tags
attack.defense-evasionattack.t1218.011detection.emerging-threats
View on GitHub