
title: Suspicious Control Panel DLL Load
author: Florian Roth
date: 2017/04/15
description: Detects suspicious Rundll32 execution from control.exe as used by Equation
  Group and Exploit Kits
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    ParentImage: '*\System32\control.exe'
  SELECTION_3:
    Image: '*\rundll32.exe '
  SELECTION_4:
    CommandLine: '*Shell32.dll*'
  condition: (SELECTION_1 and (SELECTION_2 and SELECTION_3) and  not (SELECTION_4))
falsepositives:
- Unknown
fields:
- CommandLine
- ParentCommandLine
id: d7eb979b-c2b5-4a6f-a3a7-c87ce6763819
level: high
logsource:
  category: process_creation
  product: windows
modified: 2020/09/05
references:
- https://twitter.com/rikvduijn/status/853251879320662017
status: experimental
tags:
- attack.defense_evasion
- attack.t1085
- attack.t1218.011
ruletype: SIGMA
