Windows Rundll32 Executes 1.dll DllRegisterServer via Single-Digit DLL

Flags rundll32.exe running 1.dll with DllRegisterServer, a pattern seen in suspicious DLL execution.

FreeUnreviewedSigmahighv1

windows-rundll32-executes-1-dll-dllregisterserver-via-single-digit-dll-2bd8e100

title: Windows Rundll32 Executes 1.dll DllRegisterServer via Single-Digit DLL
id: db0e9f33-7c6b-4826-8300-d286c7034d03
status: test
description: This rule identifies process executions where rundll32.exe runs a DLL named "1.dll" and invokes the export function DllRegisterServer. Single-digit DLL naming and registration function execution are commonly used in malware loading and execution chains to evade simple detections. It relies on Windows process creation telemetry, matching the rundll32 image path and the specific command-line endings for the DLL and export name.
references:
  - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
  - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/IcedID/proc_creation_win_malware_icedid_rundll32_dllregisterserver.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-31
tags:
  - attack.stealth
  - attack.t1218.011
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \rundll32.exe
    CommandLine|endswith:
      - \1.dll, DllRegisterServer
      - " 1.dll, DllRegisterServer"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2bd8e100-5b3b-4b6a-bbb5-b129d3ddddc5
    type: derived

What it detects

This rule identifies process executions where rundll32.exe runs a DLL named "1.dll" and invokes the export function DllRegisterServer. Single-digit DLL naming and registration function execution are commonly used in malware loading and execution chains to evade simple detections. It relies on Windows process creation telemetry, matching the rundll32 image path and the specific command-line endings for the DLL and export name.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.