Phoenix
Sigma IntelligenceBeta
Back to Rules
Emerging Threathightest

Injected Browser Process Spawning Rundll32 - GuLoader Activity

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
kostastsaleCreated Mon Aug 0789e1490f-1a3e-452a-bbb8-b68a5f58072f2023
Emerging Threat
Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
        Image|endswith: '\rundll32.exe'
        CommandLine|endswith: '\rundll32.exe'
    condition: selection
False Positives
Unlikely

False positives are unlikely for most environments. High confidence detection.

References
1
Resolving title…
Internal Research
MITRE ATT&CK

Other

detection.emerging-threats
Rule Metadata
Rule ID
89e1490f-1a3e-452a-bbb8-b68a5f58072f
Status
test
Level
high
Type
Emerging Threat
Created
Mon Aug 07
Author
kostastsale
Path
rules-emerging-threats/2023/Malware/GuLoader/proc_creation_win_malware_guloader_execution.yml
Raw Tags
attack.privilege-escalationattack.defense-evasionattack.t1055detection.emerging-threats
View on GitHub