Cortex XDR

Copy

> Make sure you're comfortable with the results in your own environment before using this more widely.

# Snippet - 

## Rundll32 loading a DLL by export with an HTTP path

Scenario: a scenario where an adversary uses `rundll32.exe` to execute code inside a benign-looking system process. A reliable tell is a command line that references an HTTP(S) URL, a UNC path, or a freshly written DLL in a
user-writable directory, together with an export name after the comma.

- [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/)
- [https://lolbas-project.github.io/lolbas/Binaries/Rundll32/](https://lolbas-project.github.io/lolbas/Binaries/Rundll32/)

Logic: focuses on the LOLBin pattern where `rundll32` is asked to load a DLL from somewhere it ought never to load one (web URL or remote share). Triage by causality parent and by the DLL path on the command line.

// Make sure you're comfortable with the results in your own environment before using this more widely.
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "rundll32.exe"
| filter lowercase(action_process_image_command_line) contains "http://"
    or lowercase(action_process_image_command_line) contains "https://"
    or lowercase(action_process_image_command_line) contains "\\\\"
| fields _time, agent_hostname, actor_effective_username,
    causality_actor_process_image_name, action_process_image_command_line
| limit 200