recon-with-rundll

id: c720f607-7f7b-41c8-bed9-2d9a240d965c
name: recon-with-rundll
description: |
  This query was originally published in the threat analytics report, Trickbot: Pervasive & underestimated.
  Trickbot is a very prevalent piece of malware with an array of malicious capabilities. Originally designed to steal banking credentials, it has since evolved into a modular trojan that can deploy other malware, disable security software, and perform command and control (C2) operations.
  Trickbot operators are known to use the legitimate Windows process rundll.exe to perform malicious activities, such as reconnaissance. Once a target is infected, the operator will drop a batch file that runs several commands and connects to a C2 server for further action.
  The following query detects suspicious rundll.exe activity associated with Trickbot campaigns.
  See Office applications launching wscript.exe to run JScript for another query related to Trickbot activity.
  Reference - https://attack.mitre.org/software/S0266/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
tactics:
- Discovery
- Collection
- Command and control
query: |
  DeviceNetworkEvents
  | where InitiatingProcessFileName =~ "rundll32.exe"
  // Empty command line
  | where InitiatingProcessCommandLine has "rundll32.exe" and InitiatingProcessCommandLine !contains " " 
  and InitiatingProcessCommandLine != "" 
  | summarize DestinationIPCount = dcount(RemoteIP), make_set(RemoteIP), make_set(RemoteUrl), 
  make_set(RemotePort) by InitiatingProcessCommandLine, DeviceId, bin(Timestamp, 5m)