Windows rundll32.exe execution with no parameters or arguments

Alerts on Windows rundll32.exe being started with an empty/no-parameter command line.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Bartlomiej Czyz, Relativity (SigmaHQ), DRL 1.1
Published: 2021-01-31
Updated: 2026-07-30

ATT&CK techniques

Execution → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
- T1569.002Service Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.002SMB/Windows Admin Shares
- T1570Lateral Tool Transfer
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where rundll32.exe is launched with no command-line parameters or arguments beyond the executable name. Attackers may use rundll32 to execute functionality indirectly while keeping the command line minimal, so the absence of parameters can be a useful anomaly indicator. Telemetry required is Windows process creation with access to the full CommandLine field.

Reporting behind it

Related detections9 linkedT1021.002 — drag to rearrange

Windows Service Installation (EID 4697) for SMB PsExec by Metasploit or Impacket

Suspicious Ransomware Fan-Out Deployment via PsExec Spread (Qilin)

Malicious Remote Process Execution From an SMB Admin Share (via process_creation)

Malicious PsExec Service Installation via PSEXESVC

Suspicious Lateral Movement via PsExec Service (via process_creation)

Possible PsExec Remote Service Installation with Randomly Named Service (via security)

Suspicious PsExec Copying Payload To Windows Temp (via process_creation)

Windows Named Pipe Creation: Default RemCom Pipe Name

Windows Named Pipe Created for CSExec Default Pipe Name

Windows rundll32.exe execution with no parameters or arguments

Pivot detection · T1021.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-rundll32-exe-execution-with-no-parameters-or-arguments-5bb68627

title: Windows rundll32.exe execution with no parameters or arguments
id: 56c9dfdc-cbe4-4713-a7b7-4ae91dbb6192
status: test
description: This rule flags process creation events where rundll32.exe is launched with no command-line parameters or arguments beyond the executable name. Attackers may use rundll32 to execute functionality indirectly while keeping the command line minimal, so the absence of parameters can be a useful anomaly indicator. Telemetry required is Windows process creation with access to the full CommandLine field.
references:
  - https://bczyz1.github.io/2021/01/30/psexec.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_without_parameters.yml
author: Bartlomiej Czyz, Relativity, Huntrule Team
date: 2021-01-31
modified: 2023-02-28
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1570
  - attack.execution
  - attack.t1569.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine:
      - rundll32.exe
      - rundll32
  condition: selection
falsepositives:
  - False positives may occur if a user called rundll32 from CLI with no options
level: high
license: DRL-1.1
related:
  - id: 5bb68627-3198-40ca-b458-49f973db8752
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL