Shell32 DLL Execution in Suspicious Directory

Title: Shell32 DLL Execution in Suspicious Directory
Status: test
Description:Detects shell32.dll executing a DLL in a suspicious directory
References:
  -https://www.group-ib.com/resources/threat-research/red-curl-2.html
Author: Christian Burkard (Nextron Systems)
Date: 2021-11-24
modified:2023-02-09
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1218.011'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\rundll32.exe' OriginalFileName:'RUNDLL32.EXE'   selection_cli:
    CommandLine|contains|all:
      -'shell32.dll'
      -'Control_RunDLL'

    CommandLine|contains:
      -'%AppData%'
      -'%LocalAppData%'
      -'%Temp%'
      -'%tmp%'
      -'\AppData\'
      -'\Temp\'
      -'\Users\Public\'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high