
title: Suspicious Cmdl32 Execution
author: frack113
date: 2021/11/03
description: lolbas Cmdl32 is use to download a payload to evade antivirus
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image: '*\cmdl32.exe'
  SELECTION_3:
    OriginalFileName: CMDL32.EXE
  SELECTION_4:
    CommandLine: '*/vpn *'
  SELECTION_5:
    CommandLine: '*/lan *'
  condition: (SELECTION_1 and (SELECTION_2 or SELECTION_3) and (SELECTION_4 and SELECTION_5))
falsepositives:
- unknown
id: f37aba28-a9e6-4045-882c-d5004043b337
level: medium
logsource:
  category: process_creation
  product: windows
references:
- https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/
- https://twitter.com/SwiftOnSecurity/status/1455897435063074824
status: experimental
tags:
- attack.execution
- attack.defense_evasion
- attack.t1218
- attack.t1202
ruletype: SIGMA
