Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This query idenifies when rundll32.exe executes a specific set of inline VBScript commands References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ To use this analytics rule, make sure you have deployed the ASIM normalization parsers

Attribute	Value
Type	Analytic Rule
Solution	Standalone Content
ID	bdf04f58-242b-4729-b376-577c4bdf5d3a
Severity	Medium
Kind	Scheduled
Tactics	Persistence
Techniques	T1547
Source	View on GitHub

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules