Windows Rundll32 Execution via Suspicious DLL Path Without .dll Extension

title: Windows Rundll32 Execution via Suspicious DLL Path Without .dll Extension
id: d35f6e1c-25e2-4872-a408-64c1a5a39496
status: test
description: This rule identifies rundll32.exe launched from common script and command parents (cmd.exe, cscript.exe, curl.exe, mshta.exe, PowerShell, pwsh, wscript.exe) where the rundll32 command line references common user-writable locations. It flags executions where the command line contains those paths but does not include a .dll extension, a mismatch that can indicate masqueraded or staged payloads. Telemetry required includes Windows process creation events with parent process image and full command line for rundll32.
references:
  - https://github.com/pr0xylife/Qakbot/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_fake_dll_execution.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-24
tags:
  - attack.execution
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \curl.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    Image|endswith: \rundll32.exe
    CommandLine|contains:
      - :\ProgramData\
      - :\Users\Public\
      - \AppData\Local\Temp\
      - \AppData\Roaming\
  filter_main_extension:
    CommandLine|contains: .dll
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: bfd34392-c591-4009-b938-9fd985a28b85
    type: derived