Detection rules › Splunk

DLLHost with no Command Line Arguments with Network

Author
Steven Dick, Michael Haag, Splunk
Source
upstream

The following analytic detects instances of DLLHost.exe running without command line arguments while establishing a network connection. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process execution and network activity data. It is significant because DLLHost.exe typically runs with specific arguments, and its absence can indicate malicious activity, such as Cobalt Strike usage. If confirmed malicious, this activity could allow attackers to execute code, move laterally, or exfiltrate data, posing a severe threat to the network's security.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1055 Process Injection
Defense EvasionT1055 Process Injection

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon3Network connection

Stages and Predicates

Stage 1: tstats

tstats WHERE (Processes.original_file_name="dllhost.exe" OR Processes.process_name="dllhost.exe") Processes.process IN ("*dllhost", "*dllhost.exe", "*dllhost.exe\"") BY _time, host, Processes.action, Processes.dest, Processes.original_file_name, Processes.parent_process, Processes.parent_process_exec, Processes.parent_process_guid, Processes.parent_process_id, Processes.parent_process_name, Processes.parent_process_path, Processes.process, Processes.process_exec, Processes.process_guid, Processes.process_hash, Processes.process_id, Processes.process_integrity_level, Processes.process_name, Processes.process_path, Processes.user, Processes.user_id, Processes.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: rename

rename

Stage 6: join

join type=inner (...)

Stage 7: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
All_Traffic.dest_portne
  • 0 corpus 6 (splunk 6)
Processes.original_file_nameeq
  • dllhost.exe
Processes.processin
  • "*dllhost"
  • "*dllhost.exe"
  • "*dllhost.exe\""
Processes.process_nameeq
  • dllhost.exe