Title:
Outbound Network Connection Initiated By Microsoft Dialer
Status:
test
Description:Detects outbound network connection initiated by Microsoft Dialer.
The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.
This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"
References:
-https://tria.ge/240301-rk34sagf5x/behavioral2
-https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d
-https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/
-https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html
Author: CertainlyP
Date: 2024-04-26
modified:None
Tags:
- -'attack.execution'
- -'attack.command-and-control'
- -'attack.t1071.001'
Logsource:
- category: network_connection
- product: windows
Detection:
selection:
Image|endswith:
':\Windows\System32\dialer.exe'
Initiated:
'true'
filter_main_local_ranges:
DestinationIp|cidr:
-'127.0.0.0/8'
-'10.0.0.0/8'
-'172.16.0.0/12'
-'192.168.0.0/16'
-'169.254.0.0/16'
-'::1/128'
-'fe80::/10'
-'fc00::/7'
condition:
selection and not 1 of filter_main_*
Falsepositives:
-In Modern Windows systems, unable to see legitimate usage of this process, However, if an organization has legitimate purpose for this there can be false positives.
Level:
high
