Windows Process Creation: rundll32 Executed DLL-Like Path Without .dll Extension

title: "Windows Process Creation: rundll32 Executed DLL-Like Path Without .dll Extension"
id: d35f6e1c-25e2-4872-a408-64c1a5a39496
status: test
description: This rule flags process creation where rundll32.exe is launched with command-line arguments resembling a DLL path but lacking the ".dll" extension. The behavior is notable because attackers can use rundll32 to execute code while masking the true payload characteristics. Telemetry relies on Windows process creation logs, including parent process image, child image, and full command line.
references:
  - https://github.com/pr0xylife/Qakbot/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_fake_dll_execution.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-24
tags:
  - attack.execution
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \curl.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    Image|endswith: \rundll32.exe
    CommandLine|contains:
      - :\ProgramData\
      - :\Users\Public\
      - \AppData\Local\Temp\
      - \AppData\Roaming\
  filter_main_extension:
    CommandLine|contains: .dll
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: bfd34392-c591-4009-b938-9fd985a28b85
    type: derived