detection.wiki

Detection rules › Sigma

Suspicious Network Connection Binary No CommandLine

Status
test
Severity
high
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects suspicious network connections made by a well-known Windows binary run with no command line parameters

Event coverage

ProviderEventTitle
SysmonEvent ID 3Network connection

Rule body yaml

title: Suspicious Network Connection Binary No CommandLine
id: 20384606-a124-4fec-acbb-8bd373728613
status: test
description: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters
references:
    - https://redcanary.com/blog/raspberry-robin/
author: Florian Roth (Nextron Systems)
date: 2022-07-03
tags:
    - attack.stealth
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        Image|endswith:
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\dllhost.exe'
        CommandLine|endswith:
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\dllhost.exe'
    filter_no_cmdline:
        CommandLine: ''
    filter_null: # e.g. Sysmon has no CommandLine field in network events with ID 3
        CommandLine: null
    condition: selection and not 1 of filter*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection and not 1 of filter*

Stage 1: selection

selection:
    Initiated: 'true'
    Image|endswith:
        - '\regsvr32.exe'
        - '\rundll32.exe'
        - '\dllhost.exe'
    CommandLine|endswith:
        - '\regsvr32.exe'
        - '\rundll32.exe'
        - '\dllhost.exe'

Stage 2: not filter*

filter_no_cmdline:
    CommandLine: ''
filter_null: # e.g. Sysmon has no CommandLine field in network events with ID 3
    CommandLine: null

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

StageFieldKindExcluded values
2CommandLineis_null(no value, null check)

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLineends_with
  • \dllhost.exe
  • \regsvr32.exe
  • \rundll32.exe corpus 3 (sigma 3)
Imageends_with
  • \dllhost.exe corpus 12 (sigma 12)
  • \regsvr32.exe corpus 68 (sigma 68)
  • \rundll32.exe corpus 103 (sigma 103)
Initiatedeq
  • true corpus 48 (sigma 48)