title: Rundll32 From Abnormal Drive
id: d4ca7c59-e9e4-42d8-bf57-91a776efcb87
status: experimental
description: Detects rundll32.exe executing from an abnormal drive such as a mounted ISO.
author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
date: 2022/01/25
modified: 2022/02/14
references: 
    - https://thedfirreport.com/2021/12/13/diavol-ransomware/
tags:
    - attack.t1218.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\rundll32.exe'
    filter: 
        - CurrentDirectory|contains: 'C:\'
        - CurrentDirectory: ''
    filter_null:
        CurrentDirectory: null
    condition: selection and not 1 of filter*
falsepositives:
    - Rare false positives could occur on servers with multiple drives.
level: medium
