Sigma rule: UNC2452 PowerShell Pattern

Rule

Title

UNC2452 PowerShell Pattern

Status

test

Level

critical

Author

Florian Roth (Nextron Systems)

Date

2021-01-20

Modified

2022-10-09

File

rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_ps.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

Log source

product

windows

category

process_creation

Detection

selection_cli_1:
    CommandLine|contains|all:
        - 'Invoke-WMIMethod win32_process -name create -argumentlist'
        - 'rundll32 c:\windows'
selection_cli_2:
    CommandLine|contains|all:
        - 'wmic /node:'
        - 'process call create "rundll32 c:\windows'
condition: 1 of selection_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.execution
• attack.t1059.001
• attack.t1047
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1047
• T1059.001

References

• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware
• https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-7---create-a-process-using-wmi-query-and-an-encoded-command

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_ps.yml