huntrule

Windows: Rundll32 Executions Using Obfuscated Ordinal Call Arguments

Flags rundll32.exe launches with command-line ordinal obfuscation patterns.

FreeUnreviewedSigmamediumv1
title: "Windows: Rundll32 Executions Using Obfuscated Ordinal Call Arguments"
id: d159b9a2-e911-41ea-ba6b-9639b4733e94
status: test
description: This rule identifies process creation events where rundll32.exe is executed and the command line includes obfuscation patterns consistent with ordinal-based calls. Obfuscated ordinal arguments can help an attacker evade simple string-based detections while still invoking specific exports. It relies on Windows process creation telemetry, including the executable name and the full command line content.
references:
  - Internal Research
  - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_obfuscated_ordinal_call.yml
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2023-05-17
modified: 2025-02-23
tags:
  - attack.stealth
  - attack.t1027.010
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
    - CommandLine|contains: rundll32
  selection_cli:
    CommandLine|contains:
      - "#+"
      - "#-"
      - "#0"
      - "#655"
      - "#656"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 43fa5350-db63-4b8f-9a01-789a427074e1
    type: derived

What it detects

This rule identifies process creation events where rundll32.exe is executed and the command line includes obfuscation patterns consistent with ordinal-based calls. Obfuscated ordinal arguments can help an attacker evade simple string-based detections while still invoking specific exports. It relies on Windows process creation telemetry, including the executable name and the full command line content.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.