Suspicious Image Load related to IcedId

Description

Use this query to locate suspicious load image events by rundll32.exe or regsvr32.exe, a behavior associated with IcedId, which can lead to ransomware.

Query · kql

DeviceImageLoadEvents 
| where InitiatingProcessFileName in~ ('rundll32.exe','regsvr32.exe') 
| where FileName endswith '.txt' or FileName endswith '.pdf'
Raw source Suspicious Image Load related to IcedId · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: b64c8a59-94ad-4659-b95e-36238312da5c
name: Suspicious Image Load related to IcedId
description: |
  Use this query to locate suspicious load image events by rundll32.exe or regsvr32.exe, a behavior associated with IcedId, which can lead to ransomware.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceImageLoadEvents
tactics:
- Execution
- Ransomware
query: |
  DeviceImageLoadEvents 
  | where InitiatingProcessFileName in~ ('rundll32.exe','regsvr32.exe') 
  | where FileName endswith '.txt' or FileName endswith '.pdf'

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.