Windows Rundll32 Masquerading: DllRegisterServer CommandLine Not Using rundll32.exe
Alerts when 'DllRegisterServer' appears in the command line while the executing image is not rundll32.exe.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-22
- Updated
- 2026-07-30
What it detects
This rule flags process creation on Windows where the command line contains 'DllRegisterServer' but the executed image is not rundll32.exe. Attackers may rename or substitute rundll32 to reduce the likelihood of detection while still invoking the same exported entry point. The detection relies on process creation telemetry with access to both the full command line and the process image path.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-rundll32-masquerading-dllregisterserver-commandline-not-using-rundll32-e-2569ed8c
title: "Windows Rundll32 Masquerading: DllRegisterServer CommandLine Not Using rundll32.exe"
id: b238c202-a44e-455e-81bf-c6f4a0b6dec4
related:
- id: 0ba1da6d-b6ce-4366-828c-18826c9de23e
type: derived
- id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed
type: derived
status: test
description: This rule flags process creation on Windows where the command line contains 'DllRegisterServer' but the executed image is not rundll32.exe. Attackers may rename or substitute rundll32 to reduce the likelihood of detection while still invoking the same exported entry point. The detection relies on process creation telemetry with access to both the full command line and the process image path.
references:
- https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20
- https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_rundll32_dllregisterserver.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-22
modified: 2023-02-03
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: DllRegisterServer
filter:
Image|endswith: \rundll32.exe
condition: selection and not filter
falsepositives:
- Unlikely
level: high
license: DRL-1.1