Title:RunDLL32 Spawning Explorer Status:test Description:Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way References: -https://redcanary.com/blog/intelligence-insights-november-2021/ Author: elhoim, CD_ROM_ Date: 2022-04-27 modified:2022-05-25 Tags:
-'attack.stealth'
-'attack.t1218.011'
Logsource:
category: process_creation
product: windows
Detection: selection: ParentImage|endswith:
'\rundll32.exe' Image|endswith:
'\explorer.exe' filter: ParentCommandLine|contains:
'\shell32.dll,Control_RunDLL' condition:selection and not filter Falsepositives:
-Unknown Level:high
