New Rule: Potentially Suspicious Rundll32.EXE Execution of UDL File

[tsale]

Summary of the Pull Request

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse the technique as a phishing vector to capture authentication credentials or other sensitive data.

Changelog

new: Potentially Suspicious Rundll32.EXE Execution of UDL File

Example Log Event

Type: Process Create
Image: C:\Windows\System32\rundll32.exe
ParentCommandLine: C:\Windows\Explorer.EXE
ParentUser: DESKTOP-20KZ31\admin
CurrentDirectory: C:\
CommandLine: "Rundll32.exe" "C:\Program Files\Common Files\System\OLE DB\oledb32.dll",OpenDSLFile C:\connection_test_test_gmail.com.udl
ParentImage: C:\Windows\explorer.exe
PID: 10976
User: DESKTOP-20KZ31\admin

Legitimate use of UDL files by administrative users or software that leverages OLE DB connections. Verification of such activity is required to distinguish between benign and malicious activity.

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[nasbench]

Thanks for the contribution @tsale