Detectionhightest

Rundll32 Execution Without Parameters

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Bartlomiej Czyz, RelativityCreated Sun Jan 31Updated Tue Feb 285bb68627-3198-40ca-b458-49f973db8752windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine:
            - 'rundll32.exe'
            - 'rundll32'
    condition: selection

False Positives

False positives may occur if a user called rundll32 from CLI with no options

References

MITRE ATT&CK

Tactics

Techniques

Sub-techniques

Rule Metadata

Rule ID

5bb68627-3198-40ca-b458-49f973db8752

Status

test

Level

high

Type

Detection

Created

Sun Jan 31

Modified

Tue Feb 28

Author

Path

rules/windows/process_creation/proc_creation_win_rundll32_without_parameters.yml

Raw Tags

attack.lateral-movementattack.t1021.002attack.t1570attack.executionattack.t1569.002