Trickbot Malware Process Tree (rundll32.exe parent of wermgr.exe)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•25

Detects a specific process tree pattern associated with Trickbot malware, where 'rundll32.exe' acts as the parent process for 'wermgr.exe', and the parent command line contains 'DllRegisterServer'. This pattern indicates the execution of a DLL via rundll32.exe, which then launches wermgr.exe, a known behavior of Trickbot.