Windows rundll32 Executing Inline VBScript via RegRead

title: Windows rundll32 Executing Inline VBScript via RegRead
id: 9088640f-46b7-44ec-a448-d7c82bc4b852
status: test
description: This rule flags Windows process creation events where rundll32.exe is launched with a command line containing inline VBScript components for registry reading (RegRead), script execution (Execute), and closing the window (window.close). Attackers commonly use this technique to blend script execution into a trusted Windows binary, enabling stealthy data collection and follow-on actions. Detection relies on process creation telemetry and matching specific command-line substrings indicating rundll32-driven inline VBScript behavior.
references:
  - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_inline_vbs.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-03-05
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - rundll32.exe
      - Execute
      - RegRead
      - window.close
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd
    type: derived