Windows rundll32 Locks Workstation via user32.dll LockWorkStation
Flags cmd-launched rundll32.exe calling user32.dll LockWorkStation to lock the user workstation.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-06-04
- Updated
- 2026-07-30
What it detects
This rule identifies process executions where rundll32.exe is launched from cmd.exe to call user32.dll with the LockWorkStation function. Locking a workstation can be used to disrupt a user session or conceal attacker activity, making this behavior notable when it occurs unexpectedly. The detection relies on Windows process creation telemetry including Image/OriginalFileName, parent process path, and command-line arguments containing user32.dll and LockWorkStation.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-rundll32-locks-workstation-via-user32-dll-lockworkstation-3b5b0213
title: Windows rundll32 Locks Workstation via user32.dll LockWorkStation
id: 9c7eaf60-afba-4072-b39c-58174a94438f
status: test
description: This rule identifies process executions where rundll32.exe is launched from cmd.exe to call user32.dll with the LockWorkStation function. Locking a workstation can be used to disrupt a user session or conceal attacker activity, making this behavior notable when it occurs unexpectedly. The detection relies on Windows process creation telemetry including Image/OriginalFileName, parent process path, and command-line arguments containing user32.dll and LockWorkStation.
references:
- https://app.any.run/tasks/2aef9c63-f944-4763-b3ef-81eee209d128/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_user32_dll.yml
author: frack113, Huntrule Team
date: 2022-06-04
modified: 2023-02-09
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_call_img:
- Image|endswith: \rundll32.exe
- OriginalFileName: RUNDLL32.EXE
selection_call_parent:
ParentImage|endswith: \cmd.exe
selection_call_cli:
CommandLine|contains: user32.dll,
selection_function:
CommandLine|contains: LockWorkStation
condition: all of selection_*
falsepositives:
- Scripts or links on the user desktop used to lock the workstation instead of Windows+L or the menu option
level: medium
license: DRL-1.1
related:
- id: 3b5b0213-0460-4e3f-8937-3abf98ff7dcc
type: derived