Suspicious Usage Of ShellExec_RunDLL

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•14

Detects suspicious usage of the ShellExec_RunDLL function to launch other commands, as observed in the Raspberry Robin attack. This rule specifically looks for 'ShellExec_RunDLL' in the command line combined with suspicious paths or commands like 'Desktop', 'Temp', 'Users\Public', 'comspec', 'iex', 'Invoke-', 'msiexec', 'odbcconf', or 'regsvr32'.