huntrule

Windows: Rundll32.exe launched with non-.dll extension via LOLBin parents

Flags rundll32.exe executions from common script parents where the command line references known drop locations but lacks standard extensions.

FreeUnreviewedSigmahighv1
title: "Windows: Rundll32.exe launched with non-.dll extension via LOLBin parents"
id: 3a617722-1bf0-41db-be2e-91282dcfe8f7
status: test
description: This rule identifies suspicious Windows process creation where rundll32.exe is spawned by common scripting/utility parents (cmd.exe, cscript.exe, mshta.exe, powershell/pwsh, regsvr32.exe, wscript.exe) and the rundll32 command line references typical user/program data locations. It specifically focuses on cases where the command line does not include a common benign extension (such as .dll/.cpl/.inf) and instead suggests a different file extension is being executed through rundll32.exe. This behavior matters because attackers may use rundll32.exe to run malicious payloads while masquerading the underlying file type; the rule relies on process creation telemetry including parent process image, child process image, and full command line content.
references:
  - https://github.com/pr0xylife/Pikabot
  - https://tria.ge/231004-tp8k6sch9t/behavioral2
  - https://www.virustotal.com/gui/file/56db0c4842a63234ab7fe2dda6eeb63aa7bb68f9a456985b519122f74dea37e2/behavior
  - https://tria.ge/231212-r1bpgaefar/behavioral2
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_uncommon_extension.yml
author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-01-26
tags:
  - attack.execution
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \wscript.exe
    Image|endswith: \rundll32.exe
    CommandLine|contains:
      - :\ProgramData\
      - :\Users\Public\
      - :\Windows\Installer\
      - \AppData\Local\Temp\
      - \AppData\Roaming\
  filter_main_known_extension:
    - CommandLine|contains:
        - ".cpl "
        - .cpl,
        - ".dll "
        - .dll,
        - ".inf "
        - .inf,
    - CommandLine|endswith:
        - .cpl
        - .cpl"
        - .dll
        - .dll"
        - ".inf"
        - .inf"
        - .cpl'
        - .dll'
        - .inf'
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1bf0ba65-9a39-42a2-9271-31d31bf2f0bf
    type: derived

What it detects

This rule identifies suspicious Windows process creation where rundll32.exe is spawned by common scripting/utility parents (cmd.exe, cscript.exe, mshta.exe, powershell/pwsh, regsvr32.exe, wscript.exe) and the rundll32 command line references typical user/program data locations. It specifically focuses on cases where the command line does not include a common benign extension (such as .dll/.cpl/.inf) and instead suggests a different file extension is being executed through rundll32.exe. This behavior matters because attackers may use rundll32.exe to run malicious payloads while masquerading the underlying file type; the rule relies on process creation telemetry including parent process image, child process image, and full command line content.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.