Windows rundll32.exe execution with no parameters or arguments

Alerts on Windows rundll32.exe being started with an empty/no-parameter command line.

FreeUnreviewedSigmahighv1

windows-rundll32-exe-execution-with-no-parameters-or-arguments-5bb68627

title: Windows rundll32.exe execution with no parameters or arguments
id: 56c9dfdc-cbe4-4713-a7b7-4ae91dbb6192
status: test
description: This rule flags process creation events where rundll32.exe is launched with no command-line parameters or arguments beyond the executable name. Attackers may use rundll32 to execute functionality indirectly while keeping the command line minimal, so the absence of parameters can be a useful anomaly indicator. Telemetry required is Windows process creation with access to the full CommandLine field.
references:
  - https://bczyz1.github.io/2021/01/30/psexec.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_without_parameters.yml
author: Bartlomiej Czyz, Relativity, Huntrule Team
date: 2021-01-31
modified: 2023-02-28
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1570
  - attack.execution
  - attack.t1569.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine:
      - rundll32.exe
      - rundll32
  condition: selection
falsepositives:
  - False positives may occur if a user called rundll32 from CLI with no options
level: high
license: DRL-1.1
related:
  - id: 5bb68627-3198-40ca-b458-49f973db8752
    type: derived

What it detects

This rule flags process creation events where rundll32.exe is launched with no command-line parameters or arguments beyond the executable name. Attackers may use rundll32 to execute functionality indirectly while keeping the command line minimal, so the absence of parameters can be a useful anomaly indicator. Telemetry required is Windows process creation with access to the full CommandLine field.

Known false positives

False positives may occur if a user called rundll32 from CLI with no options

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.