Windows Security Event 4697: Obfuscated Command Execution Using rundll32 and shell32.dll

title: "Windows Security Event 4697: Obfuscated Command Execution Using rundll32 and shell32.dll"
id: 97206b77-2044-4435-8625-8cf96eda4949
related:
  - id: 641a4bfb-c017-44f7-800c-2aee0184ce9b
    type: derived
  - id: cd0f7229-d16f-42de-8fe3-fba365fbcb3a
    type: derived
status: test
description: This rule flags Windows System Security Extension events (EventID 4697) where the registered service command line contains rundll32 along with shell32.dll and shellexec_rundll indicators. It also looks for command-line fragments consistent with obfuscated invocation patterns, including operators and strings such as invoke, comspec, value, and iex. Attackers may use rundll32 and script-like payload fragments to proxy execution while reducing detection visibility; this rule relies on the ServiceFileName field content in EID 4697 telemetry.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_rundll32_services_security.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains|all:
      - "&&"
      - rundll32
      - shell32.dll
      - shellexec_rundll
    ServiceFileName|contains:
      - value
      - invoke
      - comspec
      - iex
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1