Detectionmediumtest

Remote DLL Load Via Rundll32.EXE

Detects a remote DLL load event via "rundll32.exe".

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Mon Sep 18f40017b3-cb2e-4335-ab5d-3babf679c1dewindows

Log Source

WindowsImage Load (DLL)

ProductWindows← raw: windows

CategoryImage Load (DLL)← raw: image_load

Detection Logic

detection:
    selection:
        Image|endswith: '\rundll32.exe'
        ImageLoaded|startswith: '\\\\'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

Internal Research

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

f40017b3-cb2e-4335-ab5d-3babf679c1de

Status

test

Level

medium

Type

Detection

Created

Mon Sep 18

Author

Path

rules/windows/image_load/image_load_rundll32_remote_share_load.yml

Raw Tags

attack.executionattack.t1204.002