Detection rules › Sigma

Rundll32 Execution With Uncommon DLL Extension

Status
test
Severity
medium
Log source
category process_creation, product windows
Author
Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou
Source
github.com/SigmaHQ/sigma

Detects the execution of rundll32 with a command line that doesn't contain a common extension

MITRE ATT&CK coverage

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 1: Process creation

Rule body

title: Rundll32 Execution With Uncommon DLL Extension
id: c3a99af4-35a9-4668-879e-c09aeb4f2bdf
status: test
description: Detects the execution of rundll32 with a command line that doesn't contain a common extension
references:
    - https://twitter.com/mrd0x/status/1481630810495139841?s=12
author: Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou
date: 2022-01-13
modified: 2024-04-04
tags:
    - attack.stealth
    - attack.t1218.011
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\rundll32.exe'
        - OriginalFileName: 'RUNDLL32.EXE'
    filter_main_null:
        CommandLine: null
    filter_main_empty:
        CommandLine: ''
    filter_main_known_extension:
        - CommandLine|contains:
              # Note: This aims to cover: single and double quotes in addition to spaces and comma "," usage.
              - '.cpl '
              - '.cpl,'
              - '.cpl"'
              - ".cpl'"
              - '.dll '
              - '.dll,'
              - '.dll"'
              - ".dll'"
              - '.inf '
              - '.inf,'
              - '.inf"'
              - ".inf'"
        - CommandLine|endswith:
              # Note: This aims to cover: single and double quotes in addition to spaces and comma "," usage.
              - '.cpl'
              - '.dll'
              - '.inf'
    filter_main_localserver:
        CommandLine|contains: ' -localserver '
    filter_main_zzzzInvokeManagedCustomActionOutOfProc:
        ParentImage|endswith: '\msiexec.exe'
        CommandLine|contains|all:
            - ':\Windows\Installer\'
            - '.tmp'
            - 'zzzzInvokeManagedCustomActionOutOfProc'
    filter_optional_EdgeUpdate:
        ParentCommandLine|contains|all:
            - ':\Users\'
            - '\AppData\Local\Microsoft\EdgeUpdate\Install\{'
            - '\EDGEMITMP_'
            - '.tmp\setup.exe'
            - '--install-archive='
            - '--previous-version='
            - '--msedgewebview --verbose-logging --do-not-launch-msedge --user-level'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: selection

selection:
    - Image|endswith: '\rundll32.exe'
    - OriginalFileName: 'RUNDLL32.EXE'

Stage 2: not filter_main_*

filter_main_null:
    CommandLine: null
filter_main_empty:
    CommandLine: ''
filter_main_known_extension:
    - CommandLine|contains:
          - '.cpl '
          - '.cpl,'
          - '.cpl"'
          - ".cpl'"
          - '.dll '
          - '.dll,'
          - '.dll"'
          - ".dll'"
          - '.inf '
          - '.inf,'
          - '.inf"'
          - ".inf'"
    - CommandLine|endswith:
          - '.cpl'
          - '.dll'
          - '.inf'
filter_main_localserver:
    CommandLine|contains: ' -localserver '
filter_main_zzzzInvokeManagedCustomActionOutOfProc:
    ParentImage|endswith: '\msiexec.exe'
    CommandLine|contains|all:
        - ':\Windows\Installer\'
        - '.tmp'
        - 'zzzzInvokeManagedCustomActionOutOfProc'

Stage 3: not filter_optional_EdgeUpdate

filter_optional_EdgeUpdate:
    ParentCommandLine|contains|all:
        - ':\Users\'
        - '\AppData\Local\Microsoft\EdgeUpdate\Install\{'
        - '\EDGEMITMP_'
        - '.tmp\setup.exe'
        - '--install-archive='
        - '--previous-version='
        - '--msedgewebview --verbose-logging --do-not-launch-msedge --user-level'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
CommandLinematch.tmpexcludes:CommandLine field:"CommandLine" value:".tmp"
CommandLinematch:\Windows\Installer\excludes:CommandLine field:"CommandLine" value:":\Windows\Installer\"
CommandLinematchzzzzInvokeManagedCustomActionOutOfProcexcludes:CommandLine field:"CommandLine" value:"zzzzInvokeManagedCustomActionOutOfProc"
ParentImageends_with\msiexec.exeexcludes:ParentImage field:"ParentImage" value:"\msiexec.exe"
CommandLineends_with.cplexcludes:CommandLine field:"CommandLine" value:".cpl"
CommandLineends_with.dllexcludes:CommandLine field:"CommandLine" value:".dll"
CommandLineends_with.infexcludes:CommandLine field:"CommandLine" value:".inf"
CommandLineis_null(no value, null check)excludes:CommandLine
CommandLinematch -localserver excludes:CommandLine field:"CommandLine" value:" -localserver "
CommandLinematch.cpl excludes:CommandLine field:"CommandLine" value:".cpl "
CommandLinematch.cpl'excludes:CommandLine field:"CommandLine" value:".cpl'"
CommandLinematch.cpl,excludes:CommandLine field:"CommandLine" value:".cpl,"
CommandLinematch.cpl"excludes:CommandLine
CommandLinematch.dll excludes:CommandLine field:"CommandLine" value:".dll "
CommandLinematch.dll'excludes:CommandLine field:"CommandLine" value:".dll'"
CommandLinematch.dll,excludes:CommandLine field:"CommandLine" value:".dll,"
CommandLinematch.dll"excludes:CommandLine
CommandLinematch.inf excludes:CommandLine field:"CommandLine" value:".inf "
CommandLinematch.inf'excludes:CommandLine field:"CommandLine" value:".inf'"
CommandLinematch.inf,excludes:CommandLine field:"CommandLine" value:".inf,"
CommandLinematch.inf"excludes:CommandLine
ParentCommandLinematch--install-archive=excludes:ParentCommandLine field:"ParentCommandLine" value:"--install-archive="
ParentCommandLinematch--msedgewebview --verbose-logging --do-not-launch-msedge --user-levelexcludes:ParentCommandLine field:"ParentCommandLine" value:"--msedgewebview --verbose-logging --do-not-launch-msedge --user-level"
ParentCommandLinematch--previous-version=excludes:ParentCommandLine field:"ParentCommandLine" value:"--previous-version="
ParentCommandLinematch.tmp\setup.exeexcludes:ParentCommandLine field:"ParentCommandLine" value:".tmp\setup.exe"
ParentCommandLinematch:\Users\excludes:ParentCommandLine field:"ParentCommandLine" value:":\Users\"
ParentCommandLinematch\AppData\Local\Microsoft\EdgeUpdate\Install\{excludes:ParentCommandLine field:"ParentCommandLine" value:"\AppData\Local\Microsoft\EdgeUpdate\Install\{"
ParentCommandLinematch\EDGEMITMP_excludes:ParentCommandLine field:"ParentCommandLine" value:"\EDGEMITMP_"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Imageends_with
  • \rundll32.exe corpus 94 (sigma 94)
field:"Image" kind:ends_with value:"\rundll32.exe"
OriginalFileNameeq
  • RUNDLL32.EXE corpus 78 (sigma 35, elastic 22, splunk 21)
field:"OriginalFileName" kind:eq value:"RUNDLL32.EXE"