huntrule

Windows rundll32.exe launching DLLs via Cobalt Strike StartW

Alerts on rundll32.exe command lines that include a .dll and StartW function, consistent with Cobalt Strike DLL loading.

FreeUnreviewedSigmahighv1
title: Windows rundll32.exe launching DLLs via Cobalt Strike StartW
id: 995d5841-f888-44c3-b5fd-4faec46a83a3
status: test
description: This rule flags process creation events where rundll32.exe is executed with command-line arguments that include DLL loading and the StartW function. Attackers can use this technique to load malicious code from the command line while blending into legitimate Windows binary activity. The detection relies on Windows process creation telemetry, matching Image/filename indicators and specific command-line patterns for the DLL parameter and StartW usage.
references:
  - https://www.cobaltstrike.com/help-windows-executable
  - https://redcanary.com/threat-detection-report/
  - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_load_by_rundll32.yml
author: Wojciech Lesicki, Huntrule Team
date: 2021-06-01
modified: 2022-09-16
tags:
  - attack.stealth
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection_rundll:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
    - CommandLine|contains:
        - rundll32.exe
        - "rundll32 "
  selection_params:
    CommandLine|contains: .dll
    CommandLine|endswith:
      - " StartW"
      - ",StartW"
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ae9c6a7c-9521-42a6-915e-5aaa8689d529
    type: derived

What it detects

This rule flags process creation events where rundll32.exe is executed with command-line arguments that include DLL loading and the StartW function. Attackers can use this technique to load malicious code from the command line while blending into legitimate Windows binary activity. The detection relies on Windows process creation telemetry, matching Image/filename indicators and specific command-line patterns for the DLL parameter and StartW usage.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.