Windows: Ammy Admin Agent Execution via rundll32

Identifies rundll32 executions that invoke the Ammy Admin agent DLL with a run parameter on Windows.

FreeUnreviewedSigmamediumv1

windows-ammy-admin-agent-execution-via-rundll32-7da7809e

title: "Windows: Ammy Admin Agent Execution via rundll32"
id: b473e704-3e88-43e0-a13a-d4e1836af726
status: test
description: This rule flags process creation events where rundll32.exe launches an Ammy Admin component, matching the presence of the AMMYY aa_nts.dll run command in the command line. Attackers and administrators may use this behavior for remote access tooling, making the execution pattern a useful indicator for threat hunting. It relies on Windows process creation telemetry with image path and command-line content.
references:
  - https://www.ammyy.com/en/admin_features.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_remote_access_tools_ammyy_admin_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2024-08-05
tags:
  - attack.execution
  - attack.persistence
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \rundll32.exe
    CommandLine|contains: AMMYY\aa_nts.dll",run
  condition: selection
falsepositives:
  - Legitimate use of Ammy Admin RMM agent for remote management by admins.
level: medium
license: DRL-1.1
related:
  - id: 7da7809e-f3d5-47a3-9d5d-fc9d019caf14
    type: derived

What it detects

This rule flags process creation events where rundll32.exe launches an Ammy Admin component, matching the presence of the AMMYY aa_nts.dll run command in the command line. Attackers and administrators may use this behavior for remote access tooling, making the execution pattern a useful indicator for threat hunting. It relies on Windows process creation telemetry with image path and command-line content.

Known false positives

Legitimate use of Ammy Admin RMM agent for remote management by admins.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.