Rundll32 Execution Without CommandLine Parameters

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity

Known false positives

Possible but rare

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1202` Indirect Command Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Rundll32 Execution Without CommandLine Parameters
id: 1775e15e-b61b-4d14-a1a3-80981298085a
status: test
description: Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity
references:
    - https://www.cobaltstrike.com/help-opsec
    - https://twitter.com/ber_m1ng/status/1397948048135778309
author: Florian Roth (Nextron Systems)
date: 2021-05-27
modified: 2023-08-31
tags:
    - attack.stealth
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|endswith:
            - '\rundll32.exe'
            - '\rundll32.exe"'
            - '\rundll32'
    filter:
        ParentImage|contains:
            - '\AppData\Local\'
            - '\Microsoft\Edge\'
    condition: selection and not filter
falsepositives:
    - Possible but rare
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    CommandLine|endswith:
        - '\rundll32.exe'
        - '\rundll32.exe"'
        - '\rundll32'

Stage 2: `not filter`

filter:
    ParentImage|contains:
        - '\AppData\Local\'
        - '\Microsoft\Edge\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ParentImage`	match	`\AppData\Local\`	`excludes:ParentImage` `field:"ParentImage" value:"\AppData\Local\"`
`ParentImage`	match	`\Microsoft\Edge\`	`excludes:ParentImage` `field:"ParentImage" value:"\Microsoft\Edge\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	ends_with	`\rundll32` `\rundll32.exe` corpus 3 (sigma 3) `\rundll32.exe"`	`field:"CommandLine" kind:ends_with`