Suspicious Control Panel DLL Load

Title: Suspicious Control Panel DLL Load
Status: test
Description:Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits
References:
  -https://twitter.com/rikvduijn/status/853251879320662017
  -https://twitter.com/felixw3000/status/853354851128025088
Author: Florian Roth (Nextron Systems)
Date: 2017-04-15
modified:2023-02-09
Tags:

• -'attack.stealth'
• -'attack.t1218.011'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_parent:
    ParentImage|endswith: '\System32\control.exe'
  selection_img:
Image|endswith:'\rundll32.exe' OriginalFileName:'RUNDLL32.EXE'   filter:
    CommandLine|contains: 'Shell32.dll'
  condition:all of selection_* and not filter
Falsepositives:
  -Unknown
Level: high