Windows: Rundll32 Executing Registered COM Local Servers via Command-Line { }

title: "Windows: Rundll32 Executing Registered COM Local Servers via Command-Line { }"
id: c91b9afc-59df-405c-9352-741447b6bd8f
status: test
description: This rule matches process executions of rundll32.exe where the command line includes COM local server startup flags (-sta and -localserver) and contains a braced argument ({ ... }). Attackers can use rundll32 to load functionality indirectly through registered COM objects, which can aid persistence and privilege escalation. The detection relies on Windows process creation telemetry fields for Image/OriginalFileName and command-line content.
references:
  - https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_registered_com_objects.yml
author: frack113, Huntrule Team
date: 2022-02-13
modified: 2023-02-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.015
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  selection_cli:
    CommandLine|contains:
      - "-sta "
      - "-localserver "
    CommandLine|contains|all:
      - "{"
      - "}"
  condition: all of selection_*
falsepositives:
  - Legitimate use
level: high
license: DRL-1.1
related:
  - id: f1edd233-30b5-4823-9e6a-c4171b24d316
    type: derived