Rundll32 Executes Setupapi.dll InstallHinfSection via Runonce.exe

Alerts when rundll32 passes setupapi.dll::InstallHinfSection arguments that result in launching runonce.exe.

FreeUnreviewedSigmamediumv1

rundll32-executes-setupapi-dll-installhinfsection-via-runonce-exe-285b85b1

title: Rundll32 Executes Setupapi.dll InstallHinfSection via Runonce.exe
id: c42ceeed-6de3-4d1a-a127-4f3738924050
status: test
description: This rule flags process creation where rundll32.exe launches runonce.exe and the rundll32 command line contains both setupapi.dll and the InstallHinfSection function. InstallHinfSection is used to process INF files, which can include actions such as writing registry values and modifying files, enabling persistence or execution chaining. The detection relies on Windows process creation telemetry capturing the parent process image and command line text.
references:
  - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/
  - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf
  - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf
  - https://twitter.com/Z3Jpa29z/status/1313742350292746241?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml
author: Konstantin Grishchenko, oscd.community, Huntrule Team
date: 2020-10-07
modified: 2021-11-27
tags:
  - attack.stealth
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \runonce.exe
    ParentImage|endswith: \rundll32.exe
    ParentCommandLine|contains|all:
      - setupapi.dll
      - InstallHinfSection
  condition: selection
falsepositives:
  - Scripts and administrative tools that use INF files for driver installation with setupapi.dll
level: medium
license: DRL-1.1
related:
  - id: 285b85b1-a555-4095-8652-a8a4106af63f
    type: derived

What it detects

This rule flags process creation where rundll32.exe launches runonce.exe and the rundll32 command line contains both setupapi.dll and the InstallHinfSection function. InstallHinfSection is used to process INF files, which can include actions such as writing registry values and modifying files, enabling persistence or execution chaining. The detection relies on Windows process creation telemetry capturing the parent process image and command line text.

Known false positives

Scripts and administrative tools that use INF files for driver installation with setupapi.dll

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.