Suspicious Rundll32 Execution With Image Extension

Title: Suspicious Rundll32 Execution With Image Extension
Status: test
Description:Detects the execution of Rundll32.exe with DLL files masquerading as image files
References:
  -https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Author: Hieu Tran
Date: 2023-03-13
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218.011'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\rundll32.exe' OriginalFileName:'RUNDLL32.exe'   selection_cli:
    CommandLine|contains:
      -'.bmp'
      -'.cr2'
      -'.eps'
      -'.gif'
      -'.ico'
      -'.jpeg'
      -'.jpg'
      -'.nef'
      -'.orf'
      -'.png'
      -'.raw'
      -'.sr2'
      -'.tif'
      -'.tiff'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high