Midnight Blizzard - suspicious rundll32exe execution of vbscript Normalized Process Events

Back


Id	bdf04f58-242b-4729-b376-577c4bdf5d3a
Rulename	Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events)
Description	This query idenifies when rundll32.exe executes a specific set of inline VBScript commands References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ To use this analytics rule, make sure you have deployed the ASIM normalization parsers
Severity	Medium
Tactics	Persistence
Techniques	T1547
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimProcess/imProcess_MidnightBlizzard_SuspiciousRundll32Exec.yaml
Version	1.1.6
Arm template	bdf04f58-242b-4729-b376-577c4bdf5d3a.json

KQL

imProcessCreate
| where Process hassuffix 'rundll32.exe'
| where CommandLine  has_any ('Execute','RegRead','window.close')
| project TimeGenerated, Dvc, User, Process, CommandLine, ActingProcessName, EventVendor, EventProduct
| extend AccountName = tostring(split(User, @'\')[1]), AccountNTDomain = tostring(split(User, @'\')[0])
| extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)
| project-away DomainIndex

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: User
  - identifier: Name
    columnName: AccountName
  - identifier: NTDomain
    columnName: AccountNTDomain
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: Dvc
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: HostNameDomain
requiredDataConnectors: []
severity: Medium
name: Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events)
id: bdf04f58-242b-4729-b376-577c4bdf5d3a
queryPeriod: 1d
tactics:
- Persistence
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimProcess/imProcess_MidnightBlizzard_SuspiciousRundll32Exec.yaml
query: |
  imProcessCreate
  | where Process hassuffix 'rundll32.exe'
  | where CommandLine  has_any ('Execute','RegRead','window.close')
  | project TimeGenerated, Dvc, User, Process, CommandLine, ActingProcessName, EventVendor, EventProduct
  | extend AccountName = tostring(split(User, @'\')[1]), AccountNTDomain = tostring(split(User, @'\')[0])
  | extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)
  | project-away DomainIndex  
relevantTechniques:
- T1547
kind: Scheduled
triggerOperator: gt
queryFrequency: 1d
description: |
  'This query idenifies when rundll32.exe executes a specific set of inline VBScript commands
  References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
  To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'  
version: 1.1.6
tags:
- Id: d82e1987-4356-4a7b-bc5e-064f29b143c0
  version: 1.0.0
- SchemaVersion: 0.1.0
  Schema: ASIMProcessEvent
- Midnight Blizzard
triggerThreshold: 0
metadata:
  categories:
    domains:
    - Security - Threat Protection
  author:
    name: Yuval Naor
  source:
    kind: Community
  support:
    tier: Community

ARM