Windows rundll32 Locks Workstation via user32.dll LockWorkStation

Flags cmd-launched rundll32.exe calling user32.dll LockWorkStation to lock the user workstation.

FreeUnreviewedSigmamediumv1

windows-rundll32-locks-workstation-via-user32-dll-lockworkstation-3b5b0213

title: Windows rundll32 Locks Workstation via user32.dll LockWorkStation
id: 9c7eaf60-afba-4072-b39c-58174a94438f
status: test
description: This rule identifies process executions where rundll32.exe is launched from cmd.exe to call user32.dll with the LockWorkStation function. Locking a workstation can be used to disrupt a user session or conceal attacker activity, making this behavior notable when it occurs unexpectedly. The detection relies on Windows process creation telemetry including Image/OriginalFileName, parent process path, and command-line arguments containing user32.dll and LockWorkStation.
references:
  - https://app.any.run/tasks/2aef9c63-f944-4763-b3ef-81eee209d128/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_user32_dll.yml
author: frack113, Huntrule Team
date: 2022-06-04
modified: 2023-02-09
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_call_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  selection_call_parent:
    ParentImage|endswith: \cmd.exe
  selection_call_cli:
    CommandLine|contains: user32.dll,
  selection_function:
    CommandLine|contains: LockWorkStation
  condition: all of selection_*
falsepositives:
  - Scripts or links on the user desktop used to lock the workstation instead of Windows+L or the menu option
level: medium
license: DRL-1.1
related:
  - id: 3b5b0213-0460-4e3f-8937-3abf98ff7dcc
    type: derived

What it detects

This rule identifies process executions where rundll32.exe is launched from cmd.exe to call user32.dll with the LockWorkStation function. Locking a workstation can be used to disrupt a user session or conceal attacker activity, making this behavior notable when it occurs unexpectedly. The detection relies on Windows process creation telemetry including Image/OriginalFileName, parent process path, and command-line arguments containing user32.dll and LockWorkStation.

Known false positives

Scripts or links on the user desktop used to lock the workstation instead of Windows+L or the menu option

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.