title: Rundll32 Internet Connection
id: cdc8da7d-c303-42f8-b08c-b4ab47230263
status: test
description: Detects a rundll32 that communicates with public IP addresses
author: Florian Roth
references:
  - https://www.hybrid-analysis.com/sample/759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6?environmentId=100
date: 2017/11/04
modified: 2022/02/26
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\rundll32.exe'
    Initiated: 'true'
  filter:
    - DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '127.'
    - CommandLine|contains:
      - 'PcaSvc.dll,PcaPatchSdbTask'
  filter_update_processes:
    ParentImage: 'C:\Windows\System32\svchost.exe'
    RemoteAddress|endswith: ':443'
  condition: selection and not 1 of filter*
falsepositives:
  - Communication to other corporate systems that use IP addresses from public address spaces
level: medium
tags:
  - attack.defense_evasion
  - attack.t1218.011
  - attack.execution
