Windows rundll32.exe Execution via cmd/cscript/powershell with .dll and Suspicious Directories

title: Windows rundll32.exe Execution via cmd/cscript/powershell with .dll and Suspicious Directories
id: 15fd2ecb-d739-4ac1-93f0-61aab0f29017
status: test
description: This rule identifies Windows process creation where rundll32.exe is launched with a command line containing a .dll and file paths consistent with staging in ProgramData, Public, Temp, or AppData locations. It further constrains matches to rundll32.exe executions whose parent process is one of several script and command interpreters, indicating likely automated or script-driven execution. The behavior matters because rundll32 is commonly abused to load external DLLs, and attackers often blend it with common Windows execution utilities and user-writable directories. It relies on Windows process creation telemetry including parent process image, child process image, and full command-line strings.
references:
  - https://github.com/pr0xylife/Qakbot/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_execution.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-24
tags:
  - attack.execution
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: process_creation
detection:
  selection_paths:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \curl.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    Image|endswith: \rundll32.exe
    CommandLine|contains:
      - :\ProgramData\
      - :\Users\Public\
      - \AppData\Local\Temp\
      - \AppData\Roaming\
  selection_extension:
    CommandLine|contains: .dll
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: cf879ffb-793a-4753-9a14-bc8f37cc90df
    type: derived