Regsvr32 Rundll32 Image Loads Abnormal Extension

Status: available
Severity: high
Time window: 1h
Group by: InitiatingProcessCommandLine, InitiatingProcessCreationTime, InitiatingProcessFileName, InitiatingProcessId
Source: github.com/Azure/Azure-Sentinel

This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll. Joins the data to public network events. References: https://threathunt.blog/running-live-malware-for-threat-hunting-purposes/

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218.010` System Binary Proxy Execution: Regsvr32 `T1218.011` System Binary Proxy Execution: Rundll32

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceImageLoadEvents` action `any`: Image load
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `any`: Network activity

Rule body

id: 36fbd4e7-5630-4414-aa42-702a7fdded21
name: Regsvr32 Rundll32 Image Loads Abnormal Extension
description: |
  This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll.
  Joins the data to public network events.
  References:
  https://threathunt.blog/running-live-malware-for-threat-hunting-purposes/
severity: High
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
      - DeviceNetworkEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1218.010
  - T1218.011
tags:
  - Defense Evasion
  - Image Load
  - Regsvr32 Abuse
  - Rundll32 Abuse
query: |
  DeviceImageLoadEvents 
  | where InitiatingProcessFileName has_any ("rundll32.exe","regsvr32.exe")
  | where FileName !endswith ".dll"
  | join (
  DeviceNetworkEvents
  | where InitiatingProcessFileName has_any ("rundll32.exe","regsvr32.exe")
  | where RemoteIPType == "Public"
  ) on InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessCommandLine
  | project TimeGenerated, DeviceName, FileName, FolderPath, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine, LocalIP, LocalPort, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessParentFileName
  | extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
  | extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: LocalIP
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: RemoteIP
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: RemoteUrl
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

DeviceImageLoadEvents

Stage 2: `where`

| where InitiatingProcessFileName has_any ("rundll32.exe","regsvr32.exe")

Stage 3: `where`

| where FileName !endswith ".dll"

Stage 4: `join`

| join (
DeviceNetworkEvents
| where InitiatingProcessFileName has_any ("rundll32.exe","regsvr32.exe")
| where RemoteIPType == "Public"
) on InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessCommandLine

Stage 5: `project`

project DeviceName, FileName, FolderPath, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessParentFileName, LocalIP, LocalPort, RemoteIP, RemotePort, RemoteUrl, SHA1, TimeGenerated

Stage 6: `extend`

extend HostName

HostName =

ifDeviceName has "."substring(DeviceName, 0, indexof(DeviceName, '.'))

elseDeviceName

Stage 7: `extend`

extend DnsDomain

DnsDomain =

ifDeviceName has "."substring(DeviceName, (indexof(DeviceName, '.') + 1))

else""

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`InitiatingProcessFileName`	match	`regsvr32.exe` transforms: `term` corpus 2 (kusto 2) `rundll32.exe` transforms: `term` corpus 2 (kusto 2)	`field:"parent_process_name" kind:match`
`RemoteIPType`	eq	`Public` corpus 5 (kusto 5)	`field:"RemoteIPType" kind:eq value:"Public"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`FileName`	ends_with	`.dll`	`excludes:FileName` `field:"FileName" value:".dll"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DeviceName`	`project`
`FileName`	`project`
`FolderPath`	`project`
`InitiatingProcessCommandLine`	`project`
`InitiatingProcessFileName`	`project`
`InitiatingProcessParentFileName`	`project`
`LocalIP`	`project`
`LocalPort`	`project`
`RemoteIP`	`project`
`RemotePort`	`project`
`RemoteUrl`	`project`
`SHA1`	`project`
`TimeGenerated`	`project`
`HostName`	`extend`
`DnsDomain`	`extend`

Regsvr32 Rundll32 Image Loads Abnormal Extension

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: join

Stage 5: project

Stage 6: extend

Stage 7: extend