Windows Process Creation: rundll32.exe Command Line Invoking .sys Files

title: "Windows Process Creation: rundll32.exe Command Line Invoking .sys Files"
id: c9ff0369-9d57-42e0-9b59-99df25cf71e1
status: test
description: This rule identifies Windows process creation events where rundll32.exe is launched with a command line that includes a .sys file pattern ('.sys,' or '.sys '). Attackers may use rundll32 to load or reference system driver files as part of stealthy execution, making this string-based behavior a useful indicator of suspicious rundll32 usage. It relies on process creation telemetry with access to the full command line.
references:
  - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_sys.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-03-05
modified: 2022-10-09
tags:
  - attack.stealth
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains: rundll32.exe
  selection2:
    CommandLine|contains:
      - .sys,
      - ".sys "
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 731231b9-0b5d-4219-94dd-abb6959aa7ea
    type: derived