Windows: Suspicious rundll32 Execution of Non-DLL Extension via Living-off-the-Land Parent Processes
Flags rundll32.exe executions from common script parents where the command line references known drop locations but lacks standard extensions.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-01-26
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creation where rundll32.exe is launched with a command line indicating execution from common writable locations, and the rundll32-related target does not include a typical .dll/.cpl/.inf extension. Attackers may use rundll32.exe to proxy execution through a crafted DLL path, sometimes renaming or using non-standard extensions to evade detection. The detection relies on process creation telemetry, specifically parent process names, the rundll32.exe image path, and command-line content.
Reporting behind it
- github.comhttps://github.com/pr0xylife/Pikabot
- tria.gehttps://tria.ge/231004-tp8k6sch9t/behavioral2
- virustotal.comhttps://www.virustotal.com/gui/file/56db0c4842a63234ab7fe2dda6eeb63aa7bb68f9a456985b519122f74dea37e2/behavior
- tria.gehttps://tria.ge/231212-r1bpgaefar/behavioral2
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_uncommon_extension.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious rundll32 Execution of Non-DLL Extension via Living-off-the-Land Parent Processes"
id: 3a617722-1bf0-41db-be2e-91282dcfe8f7
status: test
description: This rule flags Windows process creation where rundll32.exe is launched with a command line indicating execution from common writable locations, and the rundll32-related target does not include a typical .dll/.cpl/.inf extension. Attackers may use rundll32.exe to proxy execution through a crafted DLL path, sometimes renaming or using non-standard extensions to evade detection. The detection relies on process creation telemetry, specifically parent process names, the rundll32.exe image path, and command-line content.
references:
- https://github.com/pr0xylife/Pikabot
- https://tria.ge/231004-tp8k6sch9t/behavioral2
- https://www.virustotal.com/gui/file/56db0c4842a63234ab7fe2dda6eeb63aa7bb68f9a456985b519122f74dea37e2/behavior
- https://tria.ge/231212-r1bpgaefar/behavioral2
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_uncommon_extension.yml
author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-01-26
tags:
- attack.execution
- detection.emerging-threats
- attack.stealth
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith:
- \cmd.exe
- \cscript.exe
- \mshta.exe
- \powershell.exe
- \pwsh.exe
- \regsvr32.exe
- \wscript.exe
Image|endswith: \rundll32.exe
CommandLine|contains:
- :\ProgramData\
- :\Users\Public\
- :\Windows\Installer\
- \AppData\Local\Temp\
- \AppData\Roaming\
filter_main_known_extension:
- CommandLine|contains:
- ".cpl "
- .cpl,
- ".dll "
- .dll,
- ".inf "
- .inf,
- CommandLine|endswith:
- .cpl
- .cpl"
- .dll
- .dll"
- ".inf"
- .inf"
- .cpl'
- .dll'
- .inf'
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 1bf0ba65-9a39-42a2-9271-31d31bf2f0bf
type: derived