huntrule

Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths

Detects rundll32 executions that reference DLLs stored in Alternate Data Streams via ADS-style paths.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Harjot Singh, '@cyb3rjy0t' (SigmaHQ), DRL 1.1
Published
2023-01-21
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where rundll32.exe is executed and the command line references a DLL located in an Alternate Data Stream (ADS) using a drive/path pattern with a colon separator. Attackers often use ADS to hide or store malicious payloads under legitimate-looking file paths, increasing stealth. Detection relies on Windows process creation telemetry, matching the Image/OriginalFileName for rundll32 and a command-line pattern consistent with an ADS path.

Reporting behind it

Related detections9 linkedT1564.004 — drag to rearrange
Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)
Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)
Suspicious Run Key Referencing Alternate Data Stream Payload
macOS chflags Hidden Flag Set via chflags hidden parameter
Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream
Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream
Windows suspicious file download URLs using direct IP address with script/binary extensions
Windows Named Pipe Stream Created with Known Hack Tool IMPHASHs
Windows CreateStreamHash: Suspicious Downloads From File Sharing and Paste Websites
Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths
Pivot detection · T1564.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.