Detection rules › Sigma
Suspicious ShellExec_RunDLL Call Via Ordinal
Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Evasion | T1218.011 System Binary Proxy Execution: Rundll32 |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
Stages and Predicates
Stage 1: all of selection_parent_img
ParentCommandLine|contains: SHELL32.DLL
Stage 2: all of selection_parent_ordinal
or:
ParentCommandLine|contains: '#568'
ParentCommandLine|contains: '#570'
ParentCommandLine|contains: '#572'
ParentCommandLine|contains: '#576'
Stage 3: 1 of selection_susp_cli_parent
or:
ParentCommandLine|contains: Invoke-
ParentCommandLine|contains: '\Desktop\'
ParentCommandLine|contains: '\ProgramData\'
ParentCommandLine|contains: '\Temp\'
ParentCommandLine|contains: '\Users\Public\'
ParentCommandLine|contains: comspec
ParentCommandLine|contains: iex
ParentCommandLine|contains: msiexec
ParentCommandLine|contains: odbcconf
ParentCommandLine|contains: regsvr32
Stage 4: 1 of selection_susp_child_img
or:
Image|endswith: '\bash.exe'
Image|endswith: '\bitsadmin.exe'
Image|endswith: '\cmd.exe'
Image|endswith: '\cscript.exe'
Image|endswith: '\curl.exe'
Image|endswith: '\mshta.exe'
Image|endswith: '\msiexec.exe'
Image|endswith: '\msxsl.exe'
Image|endswith: '\odbcconf.exe'
Image|endswith: '\powershell.exe'
Image|endswith: '\pwsh.exe'
Image|endswith: '\regsvr32.exe'
Image|endswith: '\schtasks.exe'
Image|endswith: '\wmic.exe'
Image|endswith: '\wscript.exe'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Image | ends_with |
|
ParentCommandLine | match |
|