Windows: rundll32.exe launched by explorer.exe parent process

title: "Windows: rundll32.exe launched by explorer.exe parent process"
id: 261075ac-a5a5-4b5a-be82-6379ba443477
status: test
description: This rule flags process creation where rundll32.exe is executed with explorer.exe as the parent process, focusing on likely rundll32 usage patterns. Launching rundll32 via the desktop shell can help attackers execute functionality while blending into normal user-initiated activity. The detection relies on process creation telemetry containing parent image and child image/filename fields plus command-line content checks to narrow matches.
references:
  - https://redcanary.com/blog/raspberry-robin/
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_parent_explorer.yml
author: CD_ROM_, Huntrule Team
date: 2022-05-21
modified: 2023-08-31
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \explorer.exe
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  filter_main_generic:
    - CommandLine|contains: " C:\\Windows\\System32\\"
    - CommandLine|endswith: " -localserver 22d8c27b-47a1-48d1-ad08-7da7abd79617"
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1723e720-616d-4ddc-ab02-f7e3685a4713
    type: derived