0

I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in which Dllhost.exe spawns a child process.

The only noticeable event(eventid:4688) was dllhost.exe --> cmd.exe which was a result of a simulated 'cmstp UAC Bypass' attack.

Scenario:

  • Threat hunting for MITRE ATT&CK T1191.
  • Initial IOC being dllhost.exe spawning child process(attacker payload/elevated shell).

I am planning not to look for specific dllhost.exe-->cmd.exe events as they limit the scope of rule.

The insight I am looking for is: If we create a detection rule for T1191 which triggers when dllhost.exe spawns a child process what is going to be the success rate and how many false positives could arise from this particular rule.

PS: Looking for events where cmstp.exe is spawned and examining the commandline for certain execution flags might seem like a better approach but that will not tell us about the final elevated program that has been launched.

0

PS: Looking for events where cmstp.exe is spawned and examining the commandline for certain execution flags might seem like a better approach but that will not tell us about the final elevated program that has been launched.

It depends on the data/visibility you have. If you have visibility to see a process's parent's command line, then one way to detect the behavior is to alert on any process whose parent has the GUID(s) associated with UAC bypass.

As far as the question of how often does dllhost.exe spawn a child process - it is fairly common. So - if you do not have visibility into parent command lines - perhaps the scope could be narrowed to command interpreters, scripting engines, and executables from "non-standard" paths, all whose parent is dllhost.exe.

0

You should probably use Sysmon or an EDR. Native Windows Security Logs alone won't help. Examining the commandline would also be helpful on rule creation and lessens the rate of false positives since it is a specific procedure/technique.


Sysmon events can also be used to identify potential abuses of CMSTP.exe. Detection strategy may depend on the specific adversary procedure, but potential rules include:

  1. To detect loading and execution of local/remote payloads - Event 1 (Process creation) where ParentImage contains CMSTP.exe and/or Event 3 (Network connection) where Image contains CMSTP.exe and DestinationIP is external.
  2. To detect Bypass User Account Control via an auto-elevated COM interface - Event 10 (ProcessAccess) where CallTrace contains CMLUA.dll and/or Event 12 or 13 (RegistryEvent) where TargetObject contains CMMGR32.exe. Also monitor for events, such as the creation of processes (Sysmon Event 1), that involve auto-elevated CMSTP COM interfaces such as CMSTPLUA (3E5FC7F9-9A51-4367-9063-A120244FBEC7) and CMLUAUTIL (3E000D72-A845-4CD9-BD83-80C07C3B881F).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.