Windows: Rundll32 Executions Using Obfuscated Ordinal Call Arguments
Flags rundll32.exe launches with command-line ordinal obfuscation patterns.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-17
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation events where rundll32.exe is executed and the command line includes obfuscation patterns consistent with ordinal-based calls. Obfuscated ordinal arguments can help an attacker evade simple string-based detections while still invoking specific exports. It relies on Windows process creation telemetry, including the executable name and the full command line content.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Rundll32 Executions Using Obfuscated Ordinal Call Arguments"
id: d159b9a2-e911-41ea-ba6b-9639b4733e94
status: test
description: This rule identifies process creation events where rundll32.exe is executed and the command line includes obfuscation patterns consistent with ordinal-based calls. Obfuscated ordinal arguments can help an attacker evade simple string-based detections while still invoking specific exports. It relies on Windows process creation telemetry, including the executable name and the full command line content.
references:
- Internal Research
- https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_obfuscated_ordinal_call.yml
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2023-05-17
modified: 2025-02-23
tags:
- attack.stealth
- attack.t1027.010
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \rundll32.exe
- OriginalFileName: RUNDLL32.EXE
- CommandLine|contains: rundll32
selection_cli:
CommandLine|contains:
- "#+"
- "#-"
- "#0"
- "#655"
- "#656"
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 43fa5350-db63-4b8f-9a01-789a427074e1
type: derived