[BUG] process_rundll32 macro looks for rundll32.exe OR RUNDLL32.EXE. #3716
Description
If you have a Splunk Support contract, creating a support case for your issue may result in faster resolution.
Support Case - 3848505
Describe the bug
Anas Faruqui identified a bug in the process_rundll32 macro used in an ESCU detection. The current macro definition is (Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE). The macro looks for rundll32.exe OR RUNDLL32.EXE. However, CrowdStrike EDR logs sometimes record rundll32 without the .exe extension. These events are not being detected by the current macro.
Expected behavior
The macro should look for rundll32* OR RUNDLL32* to detect the rundll.exe and rundll from the logs.
For example,
CommandLine: "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\PcaSvc.dll,PcaPatchSdbTask
CommandLine: RUNDLL32 C:\WINDOWS\system32\spool\DRIVERS\x64\3\PDFDESK.DLL,SetPrint 2754
Screenshots
App Version:
- ESCU: [5.15.2]
- Splunk Security Essentials: [N/A]
Additional context
To fix this modifying the macro to use wildcards, such as rundll32* and RUNDLL32*, to ensure detection of all relevant rundll32 process executions, regardless of case or the presence of the .exe extension.
Without Wildcard - Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE
With Wildcard - Processes.process_name=rundll32* OR Processes.original_file_name=RUNDLL32*
RUNDLL32 is considered as an alias for rundll32.exe
https://research.splunk.com/endpoint/f28e787e-69ca-480e-9f98-ab970e6d4bcc/?query=office