Windows: Rundll32 Executions Using Obfuscated Ordinal Call Arguments

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1027.010Command Obfuscation
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation events where rundll32.exe is executed and the command line includes obfuscation patterns consistent with ordinal-based calls. Obfuscated ordinal arguments can help an attacker evade simple string-based detections while still invoking specific exports. It relies on Windows process creation telemetry, including the executable name and the full command line content.

Reporting behind it

Related detections9 linkedT1027.010 — drag to rearrange

PowerShell Command-Line Obfuscation Constructs (via process_creation)

Windows Process Creation: Python One-Liners Decoding Base64 via Command Line

Linux Process Execution of Python Base64 Decode One-Liners

Windows CMD for /f Tokens= with Recursive Dir Listing

Windows Process Creation: Explorer Command Lines with Unicode Whitespace Padding and '#'

Windows Registry RunMRU Path with Suspicious Space Characters and Delimiter

Windows Registry: Suspicious Space-Padded TypedPaths Details String

Windows PowerShell Obfuscated COM MSI Installation via WindowsInstaller.Installer

Windows Registry Set in Shell Open Command Using PowerShell Cryptography .NET Classes

Windows: Rundll32 Executions Using Obfuscated Ordinal Call Arguments

Pivot detection · T1027.010 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-rundll32-executions-using-obfuscated-ordinal-call-arguments-43fa5350

title: "Windows: Rundll32 Executions Using Obfuscated Ordinal Call Arguments"
id: d159b9a2-e911-41ea-ba6b-9639b4733e94
status: test
description: This rule identifies process creation events where rundll32.exe is executed and the command line includes obfuscation patterns consistent with ordinal-based calls. Obfuscated ordinal arguments can help an attacker evade simple string-based detections while still invoking specific exports. It relies on Windows process creation telemetry, including the executable name and the full command line content.
references:
  - Internal Research
  - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_obfuscated_ordinal_call.yml
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2023-05-17
modified: 2025-02-23
tags:
  - attack.stealth
  - attack.t1027.010
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
    - CommandLine|contains: rundll32
  selection_cli:
    CommandLine|contains:
      - "#+"
      - "#-"
      - "#0"
      - "#655"
      - "#656"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 43fa5350-db63-4b8f-9a01-789a427074e1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL