Windows rundll32.exe launched via LOLBin chain from cmd/cscript/powershell/mshta

title: Windows rundll32.exe launched via LOLBin chain from cmd/cscript/powershell/mshta
id: 15fd2ecb-d739-4ac1-93f0-61aab0f29017
status: test
description: This rule flags Windows process creation events where rundll32.exe is executed with a command line containing paths commonly abused for staging and includes a DLL reference. It requires the parent process to be one of several scripting/command interpreters (e.g., cmd.exe, cscript.exe, powershell/pwsh, mshta, curl, or wscript), matching a behavior pattern often used to load malicious code via DLL execution. Telemetry relied on includes process creation logs with parent/child image paths and command-line content.
references:
  - https://github.com/pr0xylife/Qakbot/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_execution.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-24
tags:
  - attack.execution
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: process_creation
detection:
  selection_paths:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \curl.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    Image|endswith: \rundll32.exe
    CommandLine|contains:
      - :\ProgramData\
      - :\Users\Public\
      - \AppData\Local\Temp\
      - \AppData\Roaming\
  selection_extension:
    CommandLine|contains: .dll
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: cf879ffb-793a-4753-9a14-bc8f37cc90df
    type: derived