rundll32.exe Executing DLL from Non-standard Directory (Sysmon)

id: '27238.49667'
title: rundll32.exe Executing DLL from Non-standard Directory
description: rundll32.exe is a legitimate Windows utility used to run functions stored
  in Dynamic Link Libraries. Because rundll32 is a trusted system utility with the
  ability to execute code, it is a high value target for abuse by threat actors. Threat
  actors leveraging Qbot malware have been observed dropping DLLs into writeable paths
  and calling them with rundll32.exe. This use case detects when a DLL in a nonstandard
  directory is called by rundll32. Living Off the Land Binary and Scripts (LOLBAS)
  (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "rundll32" ".dll" | regex process_name="(?i)rundll32\.exe"| regex process!="(?i)(rundll32(\.exe)?\"?\s+(\/\w+\s+)?[\w.]+\.dll)|(C:\x5c(Windows\x5c(System32|WinSxS|SysWoW64)|Program\sFiles(\s\(x86\))?\x5c.+\.dll))"|
  table _time, host, user, process_*, process, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Windows Sysmon
references:
- https://redcanary.com/blog/lolbins-abuse/