Windows rundll32.exe Command-Line RunDLL or Control_RunDLL Execution
Alerts on rundll32.exe process launches whose command lines end with RunDLL/Control_RunDLL, indicative of DLL function loading.
- Product
- windows
- Category
- process_creation
- Author
- FPT.EagleEye (SigmaHQ), DRL 1.1
- Published
- 2020-12-25
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where rundll32.exe is executed with a command line ending in ,RunDLL or ,Control_RunDLL. Such patterns are commonly used to load exported functions from DLLs via rundll32, which can be leveraged to execute malicious code with reduced direct payload visibility. The detection relies on process creation telemetry including Image/OriginalFileName and the full CommandLine, and it excludes likely benign Control_RunDLL patterns involving .dll immediately before the argument and a specific parent process (tracker.exe).
Reporting behind it
- paste.cryptolaemus.comhttps://paste.cryptolaemus.com/emotet/2020/12/22/emotet-malware-IoCs_12-22-20.html
- cyber.wtfhttps://cyber.wtf/2021/11/15/guess-whos-back/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Emotet/proc_creation_win_malware_emotet_rundll32_execution.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows rundll32.exe Command-Line RunDLL or Control_RunDLL Execution
id: b031c283-0667-468e-8373-a0a07ddad04e
status: test
description: This rule flags Windows process creation events where rundll32.exe is executed with a command line ending in ,RunDLL or ,Control_RunDLL. Such patterns are commonly used to load exported functions from DLLs via rundll32, which can be leveraged to execute malicious code with reduced direct payload visibility. The detection relies on process creation telemetry including Image/OriginalFileName and the full CommandLine, and it excludes likely benign Control_RunDLL patterns involving .dll immediately before the argument and a specific parent process (tracker.exe).
references:
- https://paste.cryptolaemus.com/emotet/2020/12/22/emotet-malware-IoCs_12-22-20.html
- https://cyber.wtf/2021/11/15/guess-whos-back/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Emotet/proc_creation_win_malware_emotet_rundll32_execution.yml
author: FPT.EagleEye, Huntrule Team
date: 2020-12-25
modified: 2023-02-21
tags:
- attack.stealth
- attack.t1218.011
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \rundll32.exe
- OriginalFileName: RUNDLL32.EXE
selection_cli:
CommandLine|endswith:
- ",RunDLL"
- ",Control_RunDLL"
filter_legitimate_dll:
CommandLine|endswith:
- .dll,Control_RunDLL
- .dll",Control_RunDLL
- .dll',Control_RunDLL
filter_ide:
ParentImage|endswith: \tracker.exe
condition: all of selection_* and not 1 of filter_*
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 54e57ce3-0672-46eb-a402-2c0948d5e3e9
type: derived