Windows rundll32.exe Execution via cmd/cscript/powershell with .dll and Suspicious Directories
Alerts on rundll32.exe execution with DLL arguments from common Windows script/LOLBins and suspicious staging paths.
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-24
- Updated
- 2026-07-31
What it detects
This rule identifies Windows process creation where rundll32.exe is launched with a command line containing a .dll and file paths consistent with staging in ProgramData, Public, Temp, or AppData locations. It further constrains matches to rundll32.exe executions whose parent process is one of several script and command interpreters, indicating likely automated or script-driven execution. The behavior matters because rundll32 is commonly abused to load external DLLs, and attackers often blend it with common Windows execution utilities and user-writable directories. It relies on Windows process creation telemetry including parent process image, child process image, and full command-line strings.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows rundll32.exe Execution via cmd/cscript/powershell with .dll and Suspicious Directories
id: 15fd2ecb-d739-4ac1-93f0-61aab0f29017
status: test
description: This rule identifies Windows process creation where rundll32.exe is launched with a command line containing a .dll and file paths consistent with staging in ProgramData, Public, Temp, or AppData locations. It further constrains matches to rundll32.exe executions whose parent process is one of several script and command interpreters, indicating likely automated or script-driven execution. The behavior matters because rundll32 is commonly abused to load external DLLs, and attackers often blend it with common Windows execution utilities and user-writable directories. It relies on Windows process creation telemetry including parent process image, child process image, and full command-line strings.
references:
- https://github.com/pr0xylife/Qakbot/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_execution.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-24
tags:
- attack.execution
- detection.emerging-threats
- attack.stealth
logsource:
product: windows
category: process_creation
detection:
selection_paths:
ParentImage|endswith:
- \cmd.exe
- \cscript.exe
- \curl.exe
- \mshta.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
Image|endswith: \rundll32.exe
CommandLine|contains:
- :\ProgramData\
- :\Users\Public\
- \AppData\Local\Temp\
- \AppData\Roaming\
selection_extension:
CommandLine|contains: .dll
condition: all of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: cf879ffb-793a-4753-9a14-bc8f37cc90df
type: derived