Windows Rundll32 Execution Loading DLLs Exported with StartNodeRelay

Flags rundll32.exe launching a DLL that references the StartNodeRelay export in its command line.

FreeUnreviewedSigmacriticalv1

windows-rundll32-execution-loading-dlls-exported-with-startnoderelay-b18c9d4c

title: Windows Rundll32 Execution Loading DLLs Exported with StartNodeRelay
id: 8bd15a2a-81f1-4619-ad21-ecac1de2859b
status: test
description: This rule identifies process creation where rundll32.exe is used with a DLL argument containing the exported symbol name StartNodeRelay. Attackers can leverage rundll32 to load and execute functionality from DLLs, helping them blend into legitimate Windows behaviors. The detection relies on Windows process creation telemetry, specifically command-line content indicating rundll32.exe, a DLL, and the StartNodeRelay export name.
references:
  - https://github.com/FSecureLABS/C3/blob/11a081fd3be2aaf2a879f6b6e9a96ecdd24966ef/Src/NodeRelayDll/NodeRelayDll.cpp#L12
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_c3_rundll32_pattern.yml
author: Alfie Champion (ajpc500), Huntrule Team
date: 2021-06-02
modified: 2023-03-05
tags:
  - attack.stealth
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - rundll32.exe
      - .dll
      - StartNodeRelay
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: b18c9d4c-fac9-4708-bd06-dd5bfacf200f
    type: derived

What it detects

This rule identifies process creation where rundll32.exe is used with a DLL argument containing the exported symbol name StartNodeRelay. Attackers can leverage rundll32 to load and execute functionality from DLLs, helping them blend into legitimate Windows behaviors. The detection relies on Windows process creation telemetry, specifically command-line content indicating rundll32.exe, a DLL, and the StartNodeRelay export name.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.