CobaltStrike Load by Rundll32

Title: CobaltStrike Load by Rundll32
Status: test
Description:Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.
References:
  -https://www.cobaltstrike.com/help-windows-executable
  -https://redcanary.com/threat-detection-report/
  -https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/
Author: Wojciech Lesicki
Date: 2021-06-01
modified:2022-09-16
Tags:

• -'attack.stealth'
• -'attack.t1218.011'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_rundll:
Image|endswith:'\rundll32.exe' OriginalFileName:'RUNDLL32.EXE'     - CommandLine|contains:
      - 'rundll32.exe'
      - 'rundll32 '
  selection_params:
    CommandLine|contains: '.dll'
    CommandLine|endswith:
      -' StartW'
      -',StartW'

  condition:all of selection*
Falsepositives:
  -Unknown
Level: high