Windows: rundll32 Shell32 Control_RunDLL Execution of User Temp .CPL

title: "Windows: rundll32 Shell32 Control_RunDLL Execution of User Temp .CPL"
id: 69230b75-901e-45a5-9264-0761aa888d87
status: test
description: This rule flags process creation where rundll32.exe (or OriginalFileName RUNDLL32.EXE) invokes Shell32.dll Control_RunDLL to load a .CPL file from the current user’s AppData\Local\Temp directory. Attackers may use this mechanism to execute code in a way that blends into legitimate Windows component behavior, relying on .CPL control panel module loading. The detection is based on parent and process image names ending with rundll32/control.exe and on command-line indicators for Shell32.dll, Control_RunDLL, and a .CPL path under Temp.
references:
  - https://tria.ge/240226-fhbe7sdc39/behavioral1
  - https://bazaar.abuse.ch/browse/signature/RaspberryRobin/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_rundll32_shell32_cpl_exection.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-03-07
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218.011
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_img:
    ParentImage|endswith:
      - \rundll32.exe
      - \control.exe
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  selection_cli:
    CommandLine|contains|all:
      - shell32.dll
      - Control_RunDLL
      - .CPL
  selection_path:
    CommandLine|contains: \AppData\Local\Temp\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 92020b88-9caf-464f-bad8-cd0fb0aa2a81
    type: derived