Windows rundll32 Cleanup Export Execution via msupdate Service Host (ColdSteel)
Flags svchost.exe msupdate-style services spawning rundll32.exe to run cleanup-related exports.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-30
- Updated
- 2026-07-31
What it detects
This rule matches process creation where rundll32.exe is launched with a command line containing ColdSteel cleanup export-related function names, and its parent is a svchost.exe instance started with service keys such as msupdate and msupdate2. Attackers can use rundll32 with exported functions to trigger cleanup behavior while blending into legitimate Windows service hosting. The detection relies on process creation telemetry capturing parent image/command line and the child Image and CommandLine contents.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows rundll32 Cleanup Export Execution via msupdate Service Host (ColdSteel)
id: 83251de3-39b4-485a-9751-74747d5734ee
status: test
description: This rule matches process creation where rundll32.exe is launched with a command line containing ColdSteel cleanup export-related function names, and its parent is a svchost.exe instance started with service keys such as msupdate and msupdate2. Attackers can use rundll32 with exported functions to trigger cleanup behavior while blending into legitimate Windows service hosting. The detection relies on process creation telemetry capturing parent image/command line and the child Image and CommandLine contents.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/proc_creation_win_malware_coldsteel_cleanup.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-30
tags:
- attack.persistence
- detection.emerging-threats
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \svchost.exe
ParentCommandLine|contains:
- " -k msupdate"
- " -k msupdate2"
- " -k alg"
Image|endswith: \rundll32.exe
CommandLine|contains:
- UpdateDriverForPlugAndPlayDevicesW
- ServiceMain
- DiUninstallDevice
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 88516f06-ebe0-47ad-858e-ae9fd060ddea
type: derived