Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events)

Hunt Hypothesis

Adversaries may use rundll32.exe to execute inline VBScript payloads to evade detection and establish persistence. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential T1547-based attacks and disrupt advanced threat operations.

KQL Query

imProcessCreate
| where Process hassuffix 'rundll32.exe'
| where CommandLine  has_any ('Execute','RegRead','window.close')
| project TimeGenerated, Dvc, User, Process, CommandLine, ActingProcessName, EventVendor, EventProduct
| extend AccountName = tostring(split(User, @'\')[1]), AccountNTDomain = tostring(split(User, @'\')[0])
| extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)
| project-away DomainIndex

Analytic Rule Definition

id: bdf04f58-242b-4729-b376-577c4bdf5d3a
name: Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events)
description: |
  'This query idenifies when rundll32.exe executes a specific set of inline VBScript commands
  References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
  To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
severity: Medium
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
relevantTechniques:
  - T1547
tags:
  - Id: d82e1987-4356-4a7b-bc5e-064f29b143c0
    version: 1.0.0
  - Schema: ASIMProcessEvent
    SchemaVersion: 0.1.0
  - Midnight Blizzard

query: |
  imProcessCreate
  | where Process hassuffix 'rundll32.exe'
  | where CommandLine  has_any ('Execute','RegRead','window.close')
  | project TimeGenerated, Dvc, User, Process, CommandLine, ActingProcessName, EventVendor, EventProduct
  | extend AccountName = tostring(split(User, @'\')[1]), AccountNTDomain = tostring(split(User, @'\')[0])
  | extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)
  | project-away DomainIndex
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: User
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountNTDomain
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Dvc
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
version: 1.1.6
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Yuval Naor
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Protection" ]

Required Data Sources

MITRE ATT&CK Context

• Tactic: Persistence
• Tactic: Privilege Escalation
• Technique: T1547 — Boot or Logon Autostart Execution

  Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating syste

Validation (Atomic Red Team)

• T1547 — Boot or Logon Autostart Execution

References

• Source Query

False Positive Guidance

• Scenario: Scheduled Task Running VBScript for System Maintenance
  Description: A legitimate scheduled task uses rundll32.exe to execute a VBScript that performs system cleanup or log rotation.
  Filter/Exclusion: process.parent_process_name:"schtasks.exe" or process.parent_process_path:"C:\\Windows\\System32\\schtasks.exe"

• Scenario: Microsoft Baseline Security Analyzer (MSBAS) Running VBScript
  Description: The MSBAS tool uses rundll32.exe to execute VBScripts for compliance checks or patch validation.
  Filter/Exclusion: process.name:"msbas.exe" or process.parent_process_name:"msbas.exe"

• Scenario: PowerShell Script Using rundll32.exe to Execute VBScript
  Description: A PowerShell script may invoke rundll32.exe to run a VBScript as part of a legitimate automation workflow.
  Filter/Exclusion: process.parent_process_name:"powershell.exe" or process.parent_process_path:"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"

• Scenario: Group Policy Preferences (GPP) VBScript Execution
  Description: Group Policy Preferences may use rundll32.exe to execute VBScripts for user configuration or policy application.
  Filter/Exclusion: process.parent_process_name:"gpupdate.exe" or process.parent_process_path:"C:\\Windows\\System32\\gpupdate.exe"

• Scenario: Antivirus or Endpoint Protection Tool Using VBScript for Scanning
  Description: Some endpoint protection tools use rundll32.exe to execute VBScripts for on-access scanning or policy enforcement.
  Filter/Exclusion: process.name:"mpcmdrun.exe" or `process