Windows Process Creation: Suspicious ShellExec_RunDLL Command-Line Usage
Detects Windows command lines containing ShellExec_RunDLL along with other suspicious execution indicators.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-01
- Updated
- 2026-07-30
What it detects
This rule flags Windows process creation events where the command line contains ShellExec_RunDLL, indicating an attempt to launch other commands indirectly through Windows shell execution. It also looks for additional suspicious command-line fragments consistent with commonly abused execution paths and tools. The detection relies on process creation telemetry and inspection of the CommandLine field to match these specific string patterns.
Reporting behind it
- redcanary.comhttps://redcanary.com/blog/raspberry-robin/
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
- github.comhttps://github.com/SigmaHQ/sigma/issues/1009
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-suspicious-shellexec-rundll-command-line-usage-d87bd452
title: "Windows Process Creation: Suspicious ShellExec_RunDLL Command-Line Usage"
id: fea07ae2-4e64-4bf5-a5cb-049eba8f3a65
related:
- id: 36c5146c-d127-4f85-8e21-01bf62355d5a
type: obsolete
- id: 8823e85d-31d8-473e-b7f4-92da070f0fc6
type: similar
- id: d87bd452-6da1-456e-8155-7dc988157b7d
type: derived
status: test
description: This rule flags Windows process creation events where the command line contains ShellExec_RunDLL, indicating an attempt to launch other commands indirectly through Windows shell execution. It also looks for additional suspicious command-line fragments consistent with commonly abused execution paths and tools. The detection relies on process creation telemetry and inspection of the CommandLine field to match these specific string patterns.
references:
- https://redcanary.com/blog/raspberry-robin/
- https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
- https://github.com/SigmaHQ/sigma/issues/1009
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-01
modified: 2022-12-30
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_openasrundll:
CommandLine|contains: ShellExec_RunDLL
selection_suspcli:
CommandLine|contains:
- \Desktop\
- \Temp\
- \Users\Public\
- comspec
- iex
- Invoke-
- msiexec
- odbcconf
- regsvr32
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1