Windows Rundll32 Masquerading: DllRegisterServer CommandLine Not Using rundll32.exe

title: "Windows Rundll32 Masquerading: DllRegisterServer CommandLine Not Using rundll32.exe"
id: b238c202-a44e-455e-81bf-c6f4a0b6dec4
related:
  - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e
    type: derived
  - id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed
    type: derived
status: test
description: This rule flags process creation on Windows where the command line contains 'DllRegisterServer' but the executed image is not rundll32.exe. Attackers may rename or substitute rundll32 to reduce the likelihood of detection while still invoking the same exported entry point. The detection relies on process creation telemetry with access to both the full command line and the process image path.
references:
  - https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20
  - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_rundll32_dllregisterserver.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-22
modified: 2023-02-03
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: DllRegisterServer
  filter:
    Image|endswith: \rundll32.exe
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1