Suspicious Network Connection by System Binary with No Command Line

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects suspicious network connections initiated by specific Windows binaries (regsvr32.exe, rundll32.exe, dllhost.exe) when they are executed without any command-line parameters. This behavior can indicate an attempt to evade detection by leveraging legitimate system binaries for malicious network communication, potentially associated with malware like Raspberry Robin.