Windows rundll32 execution matching ZxShell function and remote disk strings
Alerts on rundll32.exe command lines containing zxFunction and RemoteDiskXXXXX indicative of ZxShell execution.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro (SigmaHQ), DRL 1.1
- Published
- 2017-07-20
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where rundll32.exe is launched and the command line contains both the well-known zxFunction marker and the RemoteDiskXXXXX string. Attackers can use rundll32-based execution to run hidden code paths while blending in with legitimate Windows binaries. The detection relies on Windows process creation telemetry, specifically Image name endings and command-line substrings.
Reporting behind it
- hybrid-analysis.comhttps://www.hybrid-analysis.com/sample/5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16?environmentId=100
- pub-7cb8ac806c1b4c4383e585c474a24719.r2.devhttps://pub-7cb8ac806c1b4c4383e585c474a24719.r2.dev/116309e7121bc8b0e66e4166c06f7b818e1d3629.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2014/TA/Axiom/proc_creation_win_apt_zxshell.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows rundll32 execution matching ZxShell function and remote disk strings
id: ac06fea2-6723-4e17-a16c-4c26b175b1a5
status: test
description: This rule flags process creation where rundll32.exe is launched and the command line contains both the well-known zxFunction marker and the RemoteDiskXXXXX string. Attackers can use rundll32-based execution to run hidden code paths while blending in with legitimate Windows binaries. The detection relies on Windows process creation telemetry, specifically Image name endings and command-line substrings.
references:
- https://www.hybrid-analysis.com/sample/5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16?environmentId=100
- https://pub-7cb8ac806c1b4c4383e585c474a24719.r2.dev/116309e7121bc8b0e66e4166c06f7b818e1d3629.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2014/TA/Axiom/proc_creation_win_apt_zxshell.yml
author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro, Huntrule Team
date: 2017-07-20
modified: 2021-11-27
tags:
- attack.execution
- attack.stealth
- attack.t1059.003
- attack.t1218.011
- attack.s0412
- attack.g0001
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \rundll32.exe
CommandLine|contains:
- zxFunction
- RemoteDiskXXXXX
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: f0b70adb-0075-43b0-9745-e82a1c608fcc
type: derived