Windows: Rundll32 Loading shell32.dll via Control_RunDLL from User/Temp Paths

title: "Windows: Rundll32 Loading shell32.dll via Control_RunDLL from User/Temp Paths"
id: 40812edc-da6a-427c-bc99-836c441d4230
status: test
description: This rule flags process creation where rundll32.exe is launched with parameters that load shell32.dll and include the Control_RunDLL invocation. It further requires the command line to reference user or temporary directory locations such as AppData, LocalAppData, Temp/tmp, or public user paths, which can indicate staging or stealthy DLL loading. The detection relies on Windows process creation telemetry, matching rundll32 image identification and command-line substrings.
references:
  - https://www.group-ib.com/resources/threat-research/red-curl-2.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_shell32_susp_execution.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-11-24
modified: 2023-02-09
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  selection_cli:
    CommandLine|contains|all:
      - shell32.dll
      - Control_RunDLL
    CommandLine|contains:
      - "%AppData%"
      - "%LocalAppData%"
      - "%Temp%"
      - "%tmp%"
      - \AppData\
      - \Temp\
      - \Users\Public\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 32b96012-7892-429e-b26c-ac2bf46066ff
    type: derived