Windows rundll32.exe Explicit DllRegisterServer Export Calls from Non-Standard Paths

Detects rundll32.exe calling DllRegisterServer from command lines associated with non-standard DLL locations.

FreeUnreviewedSigmamediumv1

windows-rundll32-exe-explicit-dllregisterserver-export-calls-from-non-standard-p-d81a9fc6

title: Windows rundll32.exe Explicit DllRegisterServer Export Calls from Non-Standard Paths
id: 6330cfd8-c8fe-4e89-924e-dd0f8688d0f5
related:
  - id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed
    type: similar
  - id: d81a9fc6-55db-4461-b962-0e78fea5b0ad
    type: derived
status: test
description: This rule flags process creation events where rundll32.exe invokes the DLL export function DllRegisterServer via the command line. Attackers may use rundll32 to execute registration-related functionality in a way that blends into normal Windows behavior, especially when the DLL resides outside common system or Program Files locations. Detection relies on Windows process creation telemetry, matching rundll32.exe as the image and identifying the DllRegisterServer string in the command line while excluding common legitimate paths.
references:
  - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
  - https://www.virustotal.com/gui/file/94816439312563db982cd038cf77cbc5ef4c7003e3edee86e2b0f99e675ed4ed/behavior
  - https://learn.microsoft.com/en-us/windows/win32/api/olectl/nf-olectl-dllregisterserver
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_rundll32_dllregisterserver.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-10-17
tags:
  - attack.stealth
  - attack.t1218
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  selection_cmdline:
    CommandLine|contains: DllRegisterServer
  filter_main_legit_paths:
    CommandLine|contains:
      - :\Program Files (x86)
      - :\Program Files\
      - :\Windows\System32\
      - :\Windows\SysWOW64\
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Legitimate usage as part of application installation, but less likely from e.g. temporary paths.
  - Not every instance is considered malicious, but this rule will capture the malicious usages.
level: medium
license: DRL-1.1

What it detects

This rule flags process creation events where rundll32.exe invokes the DLL export function DllRegisterServer via the command line. Attackers may use rundll32 to execute registration-related functionality in a way that blends into normal Windows behavior, especially when the DLL resides outside common system or Program Files locations. Detection relies on Windows process creation telemetry, matching rundll32.exe as the image and identifying the DllRegisterServer string in the command line while excluding common legitimate paths.

Known false positives

Legitimate usage as part of application installation, but less likely from e.g. temporary paths.
Not every instance is considered malicious, but this rule will capture the malicious usages.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.