Windows rundll32 Trojan Loader Command Line with AppData Path

title: Windows rundll32 Trojan Loader Command Line with AppData Path
id: 91bc1a60-b0de-42b7-962b-c693687045e3
status: test
description: This rule identifies process creation where rundll32.exe is launched with command-line arguments that reference user AppData/local paths and specific .dat and .dll loader-related patterns. Such behavior is commonly used by malware loaders to execute additional payloads from writable user directories. It relies on Windows process creation telemetry, matching the process image name and string patterns within the command line while excluding executions originating from the Temp subdirectory.
references:
  - https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/
  - https://www.hybrid-analysis.com/sample/ff808d0a12676bfac88fd26f955154f8884f2bb7c534b9936510fd6296c543e8?environmentId=110
  - https://twitter.com/ClearskySec/status/960924755355369472
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/APT28/proc_creation_win_apt_sofacy.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2018-03-01
modified: 2023-05-31
tags:
  - attack.execution
  - attack.stealth
  - attack.g0007
  - attack.t1059.003
  - attack.t1218.011
  - car.2013-10-002
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|endswith: \rundll32.exe
    CommandLine|contains:
      - "%LOCALAPPDATA%"
      - \AppData\Local\
  selection_extensions:
    - CommandLine|contains: .dat",
    - CommandLine|endswith:
        - ".dll #1"
        - '.dll" #1'
        - .dll",#1
  filter_main_exclude_temp:
    CommandLine|contains: \AppData\Local\Temp\
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ba778144-5e3d-40cf-8af9-e28fb1df1e20
    type: derived