Windows rundll32.exe Loads DLL Exports by Ordinal (#) in Command Line

Detects rundll32.exe commands that specify DLL exports by ordinal using “.dll #” syntax.

FreeUnreviewedSigmamediumv1

windows-rundll32-exe-loads-dll-exports-by-ordinal-in-command-line-e79a9e79

title: Windows rundll32.exe Loads DLL Exports by Ordinal (#) in Command Line
id: cfa15580-4c53-4cdd-a83a-43ec8652545e
status: stable
description: "This rule flags Windows process creation events where rundll32.exe is invoked with command-line parameters indicating DLL exports are referenced by ordinal (the “#” ordinal notation). Attackers can use rundll32.exe as a signed binary to proxy execution into DLL code without directly calling an exported function by name. The detection relies on process creation telemetry, matching rundll32.exe image identification and specific command-line patterns containing ordinal syntax such as “.dll #”."
references:
  - https://web.archive.org/web/20200530031906/https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/
  - https://github.com/Neo23x0/DLLRunner
  - https://twitter.com/cyb3rops/status/1186631731543236608
  - https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_rundll32_by_ordinal.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-10-22
modified: 2024-07-16
tags:
  - attack.stealth
  - attack.t1218.011
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  selection_cli:
    CommandLine|contains:
      - ",#"
      - ", #"
      - ".dll #"
      - ".ocx #"
  filter_optional_edge:
    CommandLine|contains|all:
      - EDGEHTML.dll
      - "#141"
  filter_optional_vsbuild_dll:
    ParentImage|contains:
      - \Msbuild\Current\Bin\
      - \VC\Tools\MSVC\
      - \Tracker.exe
    CommandLine|contains:
      - \FileTracker32.dll,#1
      - \FileTracker32.dll",#1
      - \FileTracker64.dll,#1
      - \FileTracker64.dll",#1
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored environment.
  - Windows control panel elements have been identified as source (mmc).
level: medium
license: DRL-1.1
related:
  - id: e79a9e79-eb72-4e78-a628-0e7e8f59e89c
    type: derived

What it detects

This rule flags Windows process creation events where rundll32.exe is invoked with command-line parameters indicating DLL exports are referenced by ordinal (the “#” ordinal notation). Attackers can use rundll32.exe as a signed binary to proxy execution into DLL code without directly calling an exported function by name. The detection relies on process creation telemetry, matching rundll32.exe image identification and specific command-line patterns containing ordinal syntax such as “.dll #”.

Known false positives

False positives depend on scripts and administrative tools used in the monitored environment.
Windows control panel elements have been identified as source (mmc).

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.