Create proc_creation_win_rundll32_parent_explorer.yml

rules/windows/process_creation/proc_creation_win_rundll32_parent_explorer.yml

@@ -0,0 +1,23 @@
+title: Rundll32 With Suspicious Parent Process
+description: Detects suspicious start of rundll32.exe with a parent process of Explorer.exe. Variant of Raspberry Robin, as first reported by Red Canary.
+status: experimental
+references:
+    - https://redcanary.com/blog/raspberry-robin/
+author: CD_ROM_
+date: 2022/05/21
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        Image|endswith: '\rundll32.exe'
+        ParentImage|endswith: '\explorer.exe'
+    condition: selection
+fields:
+    - Image
+    - ParentImage
+falsepositives:
+    - Unknown
+level: medium
+tags:
+    - attack.defense_evasion