Detection rules › Kusto Query Language

Midnight Blizzard - suspicious rundll32.exe execution of vbscript

Author
Microsoft Security Research
Source
upstream

'This query idenifies when rundll32.exe executes a specific set of inline VBScript commands References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/'

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1547 Boot or Logon Autostart Execution
Privilege EscalationT1547 Boot or Logon Autostart Execution

Event coverage

ProviderEvent IDTitle
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: source

<union>

Stage 2: union

union of 2 branches

Stage 3: extend

Stage 4: extend

Stage 5: project-away