Unusual DLL Extension Loaded by Rundll32 or Regsvr32

[rule]
description = """
Identifies instances of RunDLL32 or Regsvr32 loading a DLL with an unusual file extension. Adversaries often abuse those
programs to proxy execution of malicious code.
"""
id = "76da5dca-ffe5-4756-85ba-3ac2e6ccf623"
license = "Elastic License v2"
name = "Unusual DLL Extension Loaded by Rundll32 or Regsvr32"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
    "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary",
]
version = "1.0.34"

query = '''
sequence by process.entity_id with maxspan=1s
 [process where event.action == "start" and process.name : ("rundll32.exe", "regsvr32.exe") and
  not (process.parent.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoBatteryGaugePackage\\*\\BGHelper.exe" and
       process.args : "ShowBatteryGauge" and process.args : "updatestatus") and
  not (process.name : "regsvr32.exe" and
       process.args : ("?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\BSPHelperObject.dll",
                       "\\\\*\\FullCase\\pegasusimaging.activex.imagxpress*.dll"))]
 [library where process.name : ("rundll32.exe", "regsvr32.exe") and
  dll.hash.sha256 : "??*" and
  not dll.name : ("*.dll", "*.cpl", "*.tmp", "*.exe", "*.tlb", "*.scr", "*.dll.mui", "*.ime", "*.tsp", "*.rbf", "*.whl") and
  not (dll.name : ("*.ocx", "*.ax") and process.name : "regsvr32.exe") and
  not dll.code_signature.status : ("trusted", "errorCode_endpoint*")  and
  not dll.path : ("?:\\Windows\\System32\\winspool.drv",
                  "?:\\Windows\\SysWOW64\\winspool.drv",
                  "?:\\Windows\\System32\\*.ime",
                  "?:\\Windows\\SysWOW64\\*.ime",
                  "?:\\Windows\\System32\\spool\\drivers\\*",
                  "?:\\Program Files (x86)\\*",
                  "?:\\Program Files\\*",
                  "?:\\Windows\\SysWOW64\\*.bpl",
                  "\\\\?\\Volume{*}\\Windows\\SysWOW64\\winspool.drv",
                  "C:\\ProgramData\\docker\\windowsfilter\\*\\Files\\Windows\\SysWOW64\\winspool.drv") and
  not dll.hash.sha256 : ("cfd375eb124d1fba73f2d46705a43ed30e8aaadca7627bab7718f674fb82df38",
                         "4af03da6cda5d673725b671dbb3fccfc4badc0651af9065216bdcddb0fef7adf",
                         "bf03c44224a2932e4c12ce02e12059f5c37b7d7ebfbbe4f2603b324c368ba2b9",
                         "9e318b33d7ae4ece36cdcd345ff6815816f9efcaf9a9b943999c6d80ae043e91",
                         "e209a8b0555f2adbb072105303d6da86c287313770c31b8e4f4b43b5e16cb9a9",
                         "b57739398fc8bf80c3de2ca2f9c5b1e5d0287700b6411acc92aec674c1c8d60c",
                         "42057c320546194514a3df24788264a1b9a6da32a0c7b6902c5afbbb0b4b9077",
                         "ae9fca8e295ed4bc5ae2ef69504c3d3c69098c330f74c5a983cff19ab58a27a8",
                         "79cf46fea3048f7f00076ddf3e16efba043dea592ca7ea5a60af92e652d37afc")
  ]
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"

[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.16.0"