Windows Suspicious rasdial.exe Process Execution
Flags Windows process executions of rasdial.exe by matching process image names ending with rasdial.exe.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- juju4 (SigmaHQ), DRL 1.1
- Published
- 2019-01-16
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creations where the executable name ends with rasdial.exe. Attackers can use rasdial to initiate or manipulate network dial-up/remote connections, which may support command-and-control or connectivity changes. The detection relies on Windows process creation telemetry that includes the process image name.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-suspicious-rasdial-exe-process-execution-6bba49bf
title: Windows Suspicious rasdial.exe Process Execution
id: 139ebe63-d92e-4338-9e35-accd63da1c38
status: test
description: This rule identifies process creations where the executable name ends with rasdial.exe. Attackers can use rasdial to initiate or manipulate network dial-up/remote connections, which may support command-and-control or connectivity changes. The detection relies on Windows process creation telemetry that includes the process image name.
references:
- https://twitter.com/subTee/status/891298217907830785
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rasdial_execution.yml
author: juju4, Huntrule Team
date: 2019-01-16
modified: 2021-11-27
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: rasdial.exe
condition: selection
falsepositives:
- False positives depend on scripts and administrative tools used in the monitored environment
level: medium
license: DRL-1.1
related:
- id: 6bba49bf-7f8c-47d6-a1bb-6b4dece4640e
type: derived