HackTool - F-Secure C3 Load by Rundll32

Title: HackTool - F-Secure C3 Load by Rundll32
Status: test
Description:F-Secure C3 produces DLLs with a default exported StartNodeRelay function.
References:
  -https://github.com/FSecureLABS/C3/blob/11a081fd3be2aaf2a879f6b6e9a96ecdd24966ef/Src/NodeRelayDll/NodeRelayDll.cpp#L12
Author: Alfie Champion (ajpc500)
Date: 2021-06-02
modified:2023-03-05
Tags:

• -'attack.stealth'
• -'attack.t1218.011'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -'rundll32.exe'
      -'.dll'
      -'StartNodeRelay'

  condition:selection
Falsepositives:
  -Unknown
Level: critical