Windows: Rundll32 Loading shell32.dll via Control_RunDLL from User/Temp Paths
Alerts on rundll32.exe loading shell32.dll with Control_RunDLL from AppData/Temp/user paths.
- Product
- windows
- Category
- process_creation
- Author
- Christian Burkard (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-11-24
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where rundll32.exe is launched with parameters that load shell32.dll and include the Control_RunDLL invocation. It further requires the command line to reference user or temporary directory locations such as AppData, LocalAppData, Temp/tmp, or public user paths, which can indicate staging or stealthy DLL loading. The detection relies on Windows process creation telemetry, matching rundll32 image identification and command-line substrings.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Rundll32 Loading shell32.dll via Control_RunDLL from User/Temp Paths"
id: 40812edc-da6a-427c-bc99-836c441d4230
status: test
description: This rule flags process creation where rundll32.exe is launched with parameters that load shell32.dll and include the Control_RunDLL invocation. It further requires the command line to reference user or temporary directory locations such as AppData, LocalAppData, Temp/tmp, or public user paths, which can indicate staging or stealthy DLL loading. The detection relies on Windows process creation telemetry, matching rundll32 image identification and command-line substrings.
references:
- https://www.group-ib.com/resources/threat-research/red-curl-2.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_shell32_susp_execution.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-11-24
modified: 2023-02-09
tags:
- attack.execution
- attack.stealth
- attack.t1218.011
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \rundll32.exe
- OriginalFileName: RUNDLL32.EXE
selection_cli:
CommandLine|contains|all:
- shell32.dll
- Control_RunDLL
CommandLine|contains:
- "%AppData%"
- "%LocalAppData%"
- "%Temp%"
- "%tmp%"
- \AppData\
- \Temp\
- \Users\Public\
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 32b96012-7892-429e-b26c-ac2bf46066ff
type: derived