Windows rundll32.exe Using ShellExecute via ShellDispatch.dll Functionality
Alerts on rundll32.exe command lines referencing RunDll_ShellExecuteW, suggesting ShellDispatch.dll ShellExecute-based execution.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-20
- Updated
- 2026-07-30
What it detects
This rule flags process creations where rundll32.exe (by Image ending with \rundll32.exe and OriginalFileName) is launched with a command line containing RunDll_ShellExecuteW. This can indicate attempt to use ShellDispatch.dll-related execution paths to invoke arbitrary binary execution through ShellExecute. Telemetry relies on Windows process creation events with Image/OriginalFileName and the full CommandLine content.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-rundll32-exe-using-shellexecute-via-shelldispatch-dll-functionality-82343930
title: Windows rundll32.exe Using ShellExecute via ShellDispatch.dll Functionality
id: db4ffe90-252f-455d-8f28-6150e471b44c
status: test
description: This rule flags process creations where rundll32.exe (by Image ending with \rundll32.exe and OriginalFileName) is launched with a command line containing RunDll_ShellExecuteW. This can indicate attempt to use ShellDispatch.dll-related execution paths to invoke arbitrary binary execution through ShellExecute. Telemetry relies on Windows process creation events with Image/OriginalFileName and the full CommandLine content.
references:
- https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_shelldispatch_potential_abuse.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-20
tags:
- attack.execution
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \rundll32.exe
- OriginalFileName: RUNDLL32.EXE
selection_cli:
CommandLine|contains: RunDll_ShellExecuteW
condition: all of selection_*
falsepositives:
- Unlikely
level: medium
license: DRL-1.1
related:
- id: 82343930-652f-43f5-ab70-2ee9fdd6d5e9
type: derived