Windows rundll32.exe executions ending with RunDLL or Control_RunDLL

Alerts on rundll32.exe process launches whose command lines end with RunDLL/Control_RunDLL, indicative of DLL function loading.

FreeUnreviewedSigmacriticalv1

windows-rundll32-exe-executions-ending-with-rundll-or-control-rundll-54e57ce3

title: Windows rundll32.exe executions ending with RunDLL or Control_RunDLL
id: b031c283-0667-468e-8373-a0a07ddad04e
status: test
description: This rule flags Windows process creation events where rundll32.exe is launched with a command line ending in “,RunDLL” or “,Control_RunDLL”. Attackers commonly use rundll32 to load exported DLL functions without spawning specialized tooling, which can help malware execute or persist while blending into normal Windows behaviors. It relies on Windows process creation telemetry including Image/OriginalFileName and full CommandLine, with exclusions for specific legitimate Control_RunDLL patterns and tracker.exe parent-child activity.
references:
  - https://paste.cryptolaemus.com/emotet/2020/12/22/emotet-malware-IoCs_12-22-20.html
  - https://cyber.wtf/2021/11/15/guess-whos-back/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Emotet/proc_creation_win_malware_emotet_rundll32_execution.yml
author: FPT.EagleEye, Huntrule Team
date: 2020-12-25
modified: 2023-02-21
tags:
  - attack.stealth
  - attack.t1218.011
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  selection_cli:
    CommandLine|endswith:
      - ",RunDLL"
      - ",Control_RunDLL"
  filter_legitimate_dll:
    CommandLine|endswith:
      - .dll,Control_RunDLL
      - .dll",Control_RunDLL
      - .dll',Control_RunDLL
  filter_ide:
    ParentImage|endswith: \tracker.exe
  condition: all of selection_* and not 1 of filter_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 54e57ce3-0672-46eb-a402-2c0948d5e3e9
    type: derived

What it detects

This rule flags Windows process creation events where rundll32.exe is launched with a command line ending in “,RunDLL” or “,Control_RunDLL”. Attackers commonly use rundll32 to load exported DLL functions without spawning specialized tooling, which can help malware execute or persist while blending into normal Windows behaviors. It relies on Windows process creation telemetry including Image/OriginalFileName and full CommandLine, with exclusions for specific legitimate Control_RunDLL patterns and tracker.exe parent-child activity.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.