Windows Rasautou.exe DLL loading with -d and export execution via -p
Flags Rasautou.exe running with -d and -p to load a DLL and execute a specified export.
- Product
- windows
- Category
- process_creation
- Author
- Julia Fomina, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-09
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation where Rasautou.exe (originally named rasdlui.exe) is executed with command-line options -d and -p to load a specified .DLL and then execute an exported entry point. Attackers can use this pattern to run code indirectly through legitimate binaries, improving stealth by blending into normal Windows execution flows. The detection relies on Windows process creation telemetry with access to the executable path/name and the full command line.
Reporting behind it
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Rasautou/
- github.comhttps://github.com/fireeye/DueDLLigence
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Rasautou.exe DLL loading with -d and export execution via -p
id: 3c126269-241b-49e0-befd-bb3bab3ca9c7
status: test
description: This rule identifies process creation where Rasautou.exe (originally named rasdlui.exe) is executed with command-line options -d and -p to load a specified .DLL and then execute an exported entry point. Attackers can use this pattern to run code indirectly through legitimate binaries, improving stealth by blending into normal Windows execution flows. The detection relies on Windows process creation telemetry with access to the executable path/name and the full command line.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Rasautou/
- https://github.com/fireeye/DueDLLigence
- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml
author: Julia Fomina, oscd.community, Huntrule Team
date: 2020-10-09
tags:
- attack.stealth
- attack.t1218
logsource:
product: windows
category: process_creation
definition: Since options '-d' and '-p' were removed in Windows 10 this rule is relevant only for Windows before 10. And as Windows 7 doesn't log command line in 4688 by default, to detect this attack you need Sysmon 1 configured or KB3004375 installed for command-line auditing (https://support.microsoft.com/en-au/help/3004375/microsoft-security-advisory-update-to-improve-windows-command-line-aud)
detection:
selection_img:
- Image|endswith: \rasautou.exe
- OriginalFileName: rasdlui.exe
selection_cli:
CommandLine|contains|all:
- " -d "
- " -p "
condition: all of selection*
falsepositives:
- Unlikely
level: medium
license: DRL-1.1
related:
- id: cd3d1298-eb3b-476c-ac67-12847de55813
type: derived