Windows Rundll32 LaunchApplication execution via pcwutl.dll

Flags rundll32.exe using pcwutl.dll to invoke LaunchApplication.

FreeUnreviewedSigmamediumv1

windows-rundll32-launchapplication-execution-via-pcwutl-dll-9386d78a

title: Windows Rundll32 LaunchApplication execution via pcwutl.dll
id: 68779d10-61a7-4892-998f-cbc9b8cc9f9e
status: test
description: This rule identifies process executions where rundll32.exe loads pcwutl.dll and calls the LaunchApplication function. Attackers can use this pattern to execute code through a signed system binary and a legitimate DLL entry point, potentially blending into normal activity. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line arguments containing both the DLL identifier and exported function name.
references:
  - https://lolbas-project.github.io/lolbas/Libraries/Pcwutl/
  - https://twitter.com/harr0ey/status/989617817849876488
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pcwutl.yml
author: Julia Fomina, oscd.community, Huntrule Team
date: 2020-10-05
modified: 2023-02-09
tags:
  - attack.stealth
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  selection_cli:
    CommandLine|contains|all:
      - pcwutl
      - LaunchApplication
  condition: all of selection_*
falsepositives:
  - Use of Program Compatibility Troubleshooter Helper
level: medium
license: DRL-1.1
related:
  - id: 9386d78a-7207-4048-9c9f-a93a7c2d1c05
    type: derived

What it detects

This rule identifies process executions where rundll32.exe loads pcwutl.dll and calls the LaunchApplication function. Attackers can use this pattern to execute code through a signed system binary and a legitimate DLL entry point, potentially blending into normal activity. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line arguments containing both the DLL identifier and exported function name.

Known false positives

Use of Program Compatibility Troubleshooter Helper

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.