Windows: rundll32.exe launched by explorer.exe parent process
Alerts when explorer.exe spawns rundll32.exe with specific command-line characteristics on Windows.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- CD_ROM_ (SigmaHQ), DRL 1.1
- Published
- 2022-05-21
- Updated
- 2026-07-30
What it detects
This rule flags process creation where rundll32.exe is executed with explorer.exe as the parent process, focusing on likely rundll32 usage patterns. Launching rundll32 via the desktop shell can help attackers execute functionality while blending into normal user-initiated activity. The detection relies on process creation telemetry containing parent image and child image/filename fields plus command-line content checks to narrow matches.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-rundll32-exe-launched-by-explorer-exe-parent-process-1723e720
title: "Windows: rundll32.exe launched by explorer.exe parent process"
id: 261075ac-a5a5-4b5a-be82-6379ba443477
status: test
description: This rule flags process creation where rundll32.exe is executed with explorer.exe as the parent process, focusing on likely rundll32 usage patterns. Launching rundll32 via the desktop shell can help attackers execute functionality while blending into normal user-initiated activity. The detection relies on process creation telemetry containing parent image and child image/filename fields plus command-line content checks to narrow matches.
references:
- https://redcanary.com/blog/raspberry-robin/
- https://thedfirreport.com/2022/09/26/bumblebee-round-two/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_parent_explorer.yml
author: CD_ROM_, Huntrule Team
date: 2022-05-21
modified: 2023-08-31
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \explorer.exe
selection_img:
- Image|endswith: \rundll32.exe
- OriginalFileName: RUNDLL32.EXE
filter_main_generic:
- CommandLine|contains: " C:\\Windows\\System32\\"
- CommandLine|endswith: " -localserver 22d8c27b-47a1-48d1-ad08-7da7abd79617"
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 1723e720-616d-4ddc-ab02-f7e3685a4713
type: derived