Windows Rundll32 Execution of Ammy Admin Agent DLL
Identifies rundll32 executions that invoke the Ammy Admin agent DLL with a run parameter on Windows.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- process_creation
- Author
- @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2024-08-05
- Updated
- 2026-07-31
What it detects
This rule identifies process creation where rundll32.exe executes Ammy Admin agent activity by invoking a specific DLL entry point. Such execution matters because RMM/remote administration components can be repurposed for covert remote control if abused. It relies on Windows process creation telemetry, matching the rundll32.exe binary name and a DLL-and-run command-line pattern consistent with the Ammy Admin agent.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-ammy-admin-agent-execution-via-rundll32-7da7809e
title: Windows Rundll32 Execution of Ammy Admin Agent DLL
id: b473e704-3e88-43e0-a13a-d4e1836af726
status: test
description: This rule identifies process creation where rundll32.exe executes Ammy Admin agent activity by invoking a specific DLL entry point. Such execution matters because RMM/remote administration components can be repurposed for covert remote control if abused. It relies on Windows process creation telemetry, matching the rundll32.exe binary name and a DLL-and-run command-line pattern consistent with the Ammy Admin agent.
references:
- https://www.ammyy.com/en/admin_features.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_remote_access_tools_ammyy_admin_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2024-08-05
tags:
- attack.execution
- attack.persistence
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \rundll32.exe
CommandLine|contains: AMMYY\aa_nts.dll",run
condition: selection
falsepositives:
- Legitimate use of Ammy Admin RMM agent for remote management by admins.
level: medium
license: DRL-1.1
related:
- id: 7da7809e-f3d5-47a3-9d5d-fc9d019caf14
type: derived