Windows rundll32 Execution With Uncommon DLL/CPL/INF Extension in Command Line

title: Windows rundll32 Execution With Uncommon DLL/CPL/INF Extension in Command Line
id: 42c7c0ec-a67b-41b6-9821-15ff7be10150
status: test
description: This rule flags process creation events where rundll32.exe is executed and the command line does not include common extension endings such as .cpl, .dll, or .inf (with various quoting and delimiter patterns). Attackers may use unusual extension handling with rundll32 to blend in while still invoking code paths via specific DLL-style arguments. The detection relies on process creation telemetry including Image/OriginalFileName and CommandLine content, with exclusions for null/empty command lines and several known benign parent-child patterns.
references:
  - https://twitter.com/mrd0x/status/1481630810495139841?s=12
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_uncommon_dll_extension.yml
author: Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou, Huntrule Team
date: 2022-01-13
modified: 2024-04-04
tags:
  - attack.stealth
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  filter_main_null:
    CommandLine: null
  filter_main_empty:
    CommandLine: ""
  filter_main_known_extension:
    - CommandLine|contains:
        - ".cpl "
        - .cpl,
        - .cpl"
        - .cpl'
        - ".dll "
        - .dll,
        - .dll"
        - .dll'
        - ".inf "
        - .inf,
        - .inf"
        - .inf'
    - CommandLine|endswith:
        - .cpl
        - .dll
        - ".inf"
  filter_main_localserver:
    CommandLine|contains: " -localserver "
  filter_main_zzzzInvokeManagedCustomActionOutOfProc:
    ParentImage|endswith: \msiexec.exe
    CommandLine|contains|all:
      - :\Windows\Installer\
      - .tmp
      - zzzzInvokeManagedCustomActionOutOfProc
  filter_optional_EdgeUpdate:
    ParentCommandLine|contains|all:
      - :\Users\
      - \AppData\Local\Microsoft\EdgeUpdate\Install\{
      - \EDGEMITMP_
      - .tmp\setup.exe
      - --install-archive=
      - --previous-version=
      - --msedgewebview --verbose-logging --do-not-launch-msedge --user-level
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c3a99af4-35a9-4668-879e-c09aeb4f2bdf
    type: derived