{"id":"T1218.011","name":"Rundll32","url":"https://attack.mitre.org/techniques/T1218/011","tactics":["stealth"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0475","stix_id":"x-mitre-detection-strategy--a51d4d34-78fc-49b7-9071-348905dd33c2","name":"Detection Strategy for T1218.011 Rundll32 Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0475","analytics":[{"id":"AN1308","stix_id":"x-mitre-analytic--2cb33f68-48f8-4ffe-86e1-bc857a300398","name":"Analytic 1308","description":"Detects rundll32.exe invoked with atypical arguments (.dll, .cpl, javascript:, mshtml). DLLs not normally loaded by rundll32 are mapped into memory. Control_RunDLL or RunHTMLApplication invoked. Suspicious DLLs or scripts accessed from disk or network. Rundll32 reaches out to external domains (e.g., fetching .sct or .hta).","url":"https://attack.mitre.org/detectionstrategies/DET0475#AN1308","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlating rundll32 invocation with DLL load or network activity within X seconds."},{"field":"ParentProcessFilter","description":"Limit detection to suspicious parent processes (e.g., explorer.exe, office apps) vs. trusted installers."},{"field":"AllowedDLLs","description":"Baseline list of legitimate DLLs frequently executed by rundll32 in the environment."},{"field":"ExternalIPRange","description":"Scope of external IP ranges considered anomalous for rundll32 network connections."}],"live":true,"detection_strategies":["DET0475"],"techniques":["T1218.011"]}],"live":true,"version":"1.0","techniques":["T1218.011"]}],"sigma_rules":[{"id":"0ea52357-cd59-4340-9981-c46c7e900428","title":"Potentially Suspicious Rundll32.EXE Execution of UDL File","author":"@kostastsale","status":"test","level":"medium","date":"2024-08-16","modified":null,"description":"Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file.\nThreat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.\n","references":["https://trustedsec.com/blog/oops-i-udld-it-again"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.command-and-control","attack.stealth","attack.t1218.011","attack.t1071"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_udl_exec.yml","techniques":["T1218.011","T1071"],"cves":[]},{"id":"15bd98ea-55f4-4d37-b09a-e7caa0fa2221","title":"Rundll32 InstallScreenSaver Execution","author":"Christopher Peacock @securepeacock, SCYTHE @scythe_io, TactiKoolSec","status":"test","level":"medium","date":"2022-04-28","modified":"2023-02-09","description":"An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver","references":["https://lolbas-project.github.io/lolbas/Libraries/Desk/","https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1218.011/T1218.011.md#atomic-test-13---rundll32-with-deskcpl"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_installscreensaver.yml","techniques":["T1218.011"],"cves":[]},{"id":"285b85b1-a555-4095-8652-a8a4106af63f","title":"Suspicious Rundll32 Setupapi.dll Activity","author":"Konstantin Grishchenko, oscd.community","status":"test","level":"medium","date":"2020-10-07","modified":"2021-11-27","description":"setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file.","references":["https://lolbas-project.github.io/lolbas/Libraries/Setupapi/","https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf","https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf","https://twitter.com/Z3Jpa29z/status/1313742350292746241?s=20"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml","techniques":["T1218.011"],"cves":[]},{"id":"2bd8e100-5b3b-4b6a-bbb5-b129d3ddddc5","title":"IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-08-31","modified":null,"description":"Detects RunDLL32.exe executing a single digit DLL named \"1.dll\" with the export function \"DllRegisterServer\". This behaviour was often seen used by malware and especially IcedID","references":["https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/","https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Malware/IcedID/proc_creation_win_malware_icedid_rundll32_dllregisterserver.yml","techniques":["T1218.011"],"cves":[]},{"id":"32b96012-7892-429e-b26c-ac2bf46066ff","title":"Shell32 DLL Execution in Suspicious Directory","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-11-24","modified":"2023-02-09","description":"Detects shell32.dll executing a DLL in a suspicious directory","references":["https://www.group-ib.com/resources/threat-research/red-curl-2.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_shell32_susp_execution.yml","techniques":["T1218.011"],"cves":[]},{"id":"3a3f81ca-652c-482b-adeb-b1c804727f74","title":"APT29 2018 Phishing Campaign File Indicators","author":"@41thexplorer","status":"stable","level":"critical","date":"2018-11-20","modified":"2023-02-20","description":"Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant","references":["https://twitter.com/DrunkBinary/status/1063075530180886529","https://www.mandiant.com/resources/blog/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1218.011","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/APT29-CozyBear/file_event_win_apt_cozy_bear_phishing_campaign_indicators.yml","techniques":["T1218.011"],"cves":[]},{"id":"3d4aebe0-6d29-45b2-a8a4-3dfde586a26d","title":"Fireball Archer Install","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-06-03","modified":"2021-11-27","description":"Detects Archer malware invocation via rundll32","references":["https://www.virustotal.com/en/file/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022/analysis/","https://www.hybrid-analysis.com/sample/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022?environmentId=100"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218.011","detection.emerging-threats"],"path":"rules-emerging-threats/2017/Malware/Fireball/proc_creation_win_malware_fireball.yml","techniques":["T1218.011"],"cves":[]},{"id":"40b6e656-4e11-4c0c-8772-c1cc6dae34ce","title":"ScreenSaver Registry Key Set","author":"Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)","status":"test","level":"medium","date":"2022-05-04","modified":"2023-08-17","description":"Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl","references":["https://twitter.com/VakninHai/status/1517027824984547329","https://twitter.com/pabraeken/status/998627081360695297","https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml","techniques":["T1218.011"],"cves":[]},{"id":"4aa6040b-3f28-44e3-a769-9208e5feb5ec","title":"Suspicious Rundll32 Execution With Image Extension","author":"Hieu Tran","status":"test","level":"high","date":"2023-03-13","modified":null,"description":"Detects the execution of Rundll32.exe with DLL files masquerading as image files","references":["https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_susp_execution_with_image_extension.yml","techniques":["T1218.011"],"cves":[]},{"id":"4c0aaedc-154c-4427-ada0-d80ef9c9deb6","title":"Process Access via TrolleyExpress Exclusion","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-10","modified":"2022-05-13","description":"Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory","references":["https://twitter.com/_xpn_/status/1491557187168178176","https://www.youtube.com/watch?v=Ie831jF0bb0"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011","attack.credential-access","attack.t1003.001"],"path":"rules/windows/process_creation/proc_creation_win_citrix_trolleyexpress_procdump.yml","techniques":["T1218.011","T1003.001"],"cves":[]},{"id":"52cad028-0ff0-4854-8f67-d25dfcbc78b4","title":"HTML Help HH.EXE Suspicious Child Process","author":"Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-04-01","modified":"2023-04-12","description":"Detects a suspicious child process of a Microsoft HTML Help (HH.exe)","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.stealth","attack.t1047","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.007","attack.t1218","attack.t1218.001","attack.t1218.010","attack.t1218.011","attack.t1566","attack.t1566.001"],"path":"rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1059.007","T1218","T1218.001","T1218.010","T1218.011","T1566","T1566.001"],"cves":[]},{"id":"54e57ce3-0672-46eb-a402-2c0948d5e3e9","title":"Potential Emotet Rundll32 Execution","author":"FPT.EagleEye","status":"test","level":"critical","date":"2020-12-25","modified":"2023-02-21","description":"Detecting Emotet DLL loading by looking for rundll32.exe processes with command lines ending in ,RunDLL or ,Control_RunDLL","references":["https://paste.cryptolaemus.com/emotet/2020/12/22/emotet-malware-IoCs_12-22-20.html","https://cyber.wtf/2021/11/15/guess-whos-back/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Malware/Emotet/proc_creation_win_malware_emotet_rundll32_execution.yml","techniques":["T1218.011"],"cves":[]},{"id":"5cdb711b-5740-4fb2-ba88-f7945027afac","title":"Rundll32 UNC Path Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-10","modified":"2026-07-20","description":"Detects rundll32 execution where the DLL is located on a remote location (share).\nThreat actors can abuse the rundll32.exe binary to execute remote DLLs from a UNC pathh.\n","references":["https://www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code","https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.lateral-movement","attack.stealth","attack.t1021.002","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_unc_path.yml","techniques":["T1021.002","T1218.011"],"cves":[]},{"id":"5cdbc2e8-86dd-43df-9a1a-200d4745fba5","title":"Rhadamanthys Stealer Module Launch Via Rundll32.EXE","author":"TropChaud","status":"test","level":"medium","date":"2023-01-26","modified":"2023-02-05","description":"Detects the use of Rundll32 to launch an NSIS module that serves as the main stealer capability of Rhadamanthys infostealer, as observed in reports and samples in early 2023","references":["https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88","https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/","https://www.joesandbox.com/analysis/790122/0/html","https://twitter.com/anfam17/status/1607477672057208835"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Malware/Rhadamanthys/proc_creation_win_malware_rhadamanthys_stealer_dll_launch.yml","techniques":["T1218.011"],"cves":[]},{"id":"6812a10b-60ea-420c-832f-dfcc33b646ba","title":"Potential PowerShell Execution Via DLL","author":"Markus Neis, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2018-08-25","modified":"2024-03-07","description":"Detects potential PowerShell execution from a DLL instead of the usual PowerShell process as seen used in PowerShdll.\nThis detection assumes that PowerShell commands are passed via the CommandLine.\n","references":["https://github.com/p3nt4/PowerShdll/blob/62cfa172fb4e1f7f4ac00ca942685baeb88ff356/README.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_susp_powershell_execution_via_dll.yml","techniques":["T1218.011"],"cves":[]},{"id":"731231b9-0b5d-4219-94dd-abb6959aa7ea","title":"Suspicious Rundll32 Activity Invoking Sys File","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-03-05","modified":"2022-10-09","description":"Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452","references":["https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_sys.yml","techniques":["T1218.011"],"cves":[]},{"id":"7453575c-a747-40b9-839b-125a0aae324b","title":"APT29 2018 Phishing Campaign CommandLine Indicators","author":"Florian Roth (Nextron Systems), @41thexplorer","status":"stable","level":"critical","date":"2018-11-20","modified":"2023-03-08","description":"Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant","references":["https://twitter.com/DrunkBinary/status/1063075530180886529","https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/","https://www.mandiant.com/resources/blog/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218.011","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/APT29-CozyBear/proc_creation_win_apt_apt29_phishing_campaign_indicators.yml","techniques":["T1218.011"],"cves":[]},{"id":"7610a4ea-c06d-495f-a2ac-0a696abcfd3b","title":"Outbound Network Connection To Public IP Via Winlogon","author":"Christopher Peacock @securepeacock, SCYTHE @scythe_io","status":"test","level":"medium","date":"2023-04-28","modified":"2024-03-12","description":"Detects a \"winlogon.exe\" process that initiate network communications with public IP addresses","references":["https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.execution","attack.command-and-control","attack.stealth","attack.t1218.011"],"path":"rules/windows/network_connection/net_connection_win_winlogon_net_connections.yml","techniques":["T1218.011"],"cves":[]},{"id":"79aeeb41-8156-4fac-a0cd-076495ab82a1","title":"NotPetya Ransomware Activity","author":"Florian Roth (Nextron Systems), Tom Ueltschi","status":"test","level":"critical","date":"2019-01-16","modified":"2022-12-15","description":"Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil","references":["https://securelist.com/schroedingers-petya/78870/","https://www.hybrid-analysis.com/sample/64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1?environmentId=100"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.defense-impairment","attack.t1218.011","attack.t1685.005","attack.credential-access","attack.t1003.001","car.2016-04-002","detection.emerging-threats"],"path":"rules-emerging-threats/2017/Malware/NotPetya/proc_creation_win_malware_notpetya.yml","techniques":["T1218.011","T1685.005","T1003.001"],"cves":[]},{"id":"8823e85d-31d8-473e-b7f4-92da070f0fc6","title":"Suspicious ShellExec_RunDLL Call Via Ordinal","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2024-12-01","modified":null,"description":"Detects suspicious call to the \"ShellExec_RunDLL\" exported function of SHELL32.DLL through the ordinal number to launch other commands.\nAdversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.\n","references":["https://redcanary.com/blog/raspberry-robin/","https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/","https://github.com/SigmaHQ/sigma/issues/1009","https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_ordinal_execution.yml","techniques":["T1218.011"],"cves":[]},{"id":"8acf3cfa-1e8c-4099-83de-a0c4038e18f0","title":"EvilNum APT Golden Chickens Deployment Via OCX Files","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-07-10","modified":"2023-03-09","description":"Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report","references":["https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/","https://app.any.run/tasks/33d37fdf-158d-4930-aa68-813e1d5eb8ba/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011","detection.emerging-threats"],"path":"rules-emerging-threats/2020/TA/Evilnum/proc_creation_win_apt_evilnum_jul20.yml","techniques":["T1218.011"],"cves":[]},{"id":"92020b88-9caf-464f-bad8-cd0fb0aa2a81","title":"Potential Raspberry Robin CPL Execution Activity","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2024-03-07","modified":null,"description":"Detects the execution of a \".CPL\" file located in the user temp directory via the Shell32 DLL \"Control_RunDLL\" export function.\nThis behavior was observed in multiple Raspberry-Robin variants.\n","references":["https://tria.ge/240226-fhbe7sdc39/behavioral1","https://bazaar.abuse.ch/browse/signature/RaspberryRobin/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218.011","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_rundll32_shell32_cpl_exection.yml","techniques":["T1218.011"],"cves":[]},{"id":"9386d78a-7207-4048-9c9f-a93a7c2d1c05","title":"Code Execution via Pcwutl.dll","author":"Julia Fomina, oscd.community","status":"test","level":"medium","date":"2020-10-05","modified":"2023-02-09","description":"Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.","references":["https://lolbas-project.github.io/lolbas/Libraries/Pcwutl/","https://twitter.com/harr0ey/status/989617817849876488"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_pcwutl.yml","techniques":["T1218.011"],"cves":[]},{"id":"95022b85-ff2a-49fa-939a-d7b8f56eeb9b","title":"HackTool - RedMimicry Winnti Playbook Execution","author":"Alexander Rausch","status":"test","level":"high","date":"2020-06-24","modified":"2023-03-01","description":"Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility","references":["https://redmimicry.com/posts/redmimicry-winnti/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1106","attack.t1059.003","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_hktl_redmimicry_winnti_playbook.yml","techniques":["T1106","T1059.003","T1218.011"],"cves":[]},{"id":"994cac2b-92c2-44bf-8853-14f6ca39fbda","title":"Potential Bumblebee Remote Thread Creation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-27","modified":null,"description":"Detects remote thread injection events based on action seen used by bumblebee","references":["https://thedfirreport.com/2022/09/26/bumblebee-round-two/"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.execution","attack.stealth","attack.t1218.011","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Malware/Bumblebee/create_remote_thread_win_malware_bumblebee.yml","techniques":["T1218.011","T1059.001"],"cves":[]},{"id":"99b97608-3e21-4bfe-8217-2a127c396a0e","title":"Remote Thread Creation Via PowerShell In Uncommon Target","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2018-06-25","modified":"2023-11-10","description":"Detects the creation of a remote thread from a Powershell process in an uncommon target process","references":["https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.execution","attack.stealth","attack.t1218.011","attack.t1059.001"],"path":"rules/windows/create_remote_thread/create_remote_thread_win_powershell_susp_targets.yml","techniques":["T1218.011","T1059.001"],"cves":[]},{"id":"a7c3d773-caef-227e-a7e7-c2f13c622329","title":"Bad Opsec Defaults Sacrificial Processes With Improper Arguments","author":"Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2020-10-23","modified":"2024-08-15","description":"Detects attackers using tooling with bad opsec defaults.\nE.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run.\nOne trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.\n","references":["https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/","https://www.cobaltstrike.com/help-opsec","https://twitter.com/CyberRaiju/status/1251492025678983169","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regsvr32","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32","https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool","https://learn.microsoft.com/en-us/dotnet/framework/tools/regsvcs-exe-net-services-installation-tool"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes.yml","techniques":["T1218.011"],"cves":[]},{"id":"a7e6b1f9-8d2c-4f1e-9a7d-63e4c8a2bf4c","title":"Kapeka Backdoor Loaded Via Rundll32.EXE","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2024-07-03","modified":null,"description":"Detects the Kapeka Backdoor binary being loaded by rundll32.exe.\nThe Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.\n","references":["https://labs.withsecure.com/publications/kapeka","https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.execution","attack.stealth","attack.t1204.002","attack.t1218.011","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Malware/kapeka/image_load_malware_kapeka_backdoor_wll.yml","techniques":["T1204.002","T1218.011"],"cves":[]},{"id":"ae9c6a7c-9521-42a6-915e-5aaa8689d529","title":"CobaltStrike Load by Rundll32","author":"Wojciech Lesicki","status":"test","level":"high","date":"2021-06-01","modified":"2022-09-16","description":"Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.","references":["https://www.cobaltstrike.com/help-windows-executable","https://redcanary.com/threat-detection-report/","https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_load_by_rundll32.yml","techniques":["T1218.011"],"cves":[]},{"id":"b18c9d4c-fac9-4708-bd06-dd5bfacf200f","title":"HackTool - F-Secure C3 Load by Rundll32","author":"Alfie Champion (ajpc500)","status":"test","level":"critical","date":"2021-06-02","modified":"2023-03-05","description":"F-Secure C3 produces DLLs with a default exported StartNodeRelay function.","references":["https://github.com/FSecureLABS/C3/blob/11a081fd3be2aaf2a879f6b6e9a96ecdd24966ef/Src/NodeRelayDll/NodeRelayDll.cpp#L12"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_hktl_c3_rundll32_pattern.yml","techniques":["T1218.011"],"cves":[]},{"id":"b5de0c9a-6f19-43e0-af4e-55ad01f550af","title":"Unsigned DLL Loaded by Windows Utility","author":"Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2024-02-28","modified":"2025-10-07","description":"Detects windows utilities loading an unsigned or untrusted DLL.\nAdversaries often abuse those programs to proxy execution of malicious code.\n","references":["https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion","https://akhere.hashnode.dev/hunting-unsigned-dlls-using-kql","https://unit42.paloaltonetworks.com/unsigned-dlls/?web_view=true"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.stealth","attack.t1218.011","attack.t1218.010"],"path":"rules/windows/image_load/image_load_susp_unsigned_dll.yml","techniques":["T1218.011","T1218.010"],"cves":[]},{"id":"ba778144-5e3d-40cf-8af9-e28fb1df1e20","title":"Sofacy Trojan Loader Activity","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2018-03-01","modified":"2023-05-31","description":"Detects Trojan loader activity as used by APT28","references":["https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/","https://www.hybrid-analysis.com/sample/ff808d0a12676bfac88fd26f955154f8884f2bb7c534b9936510fd6296c543e8?environmentId=110","https://twitter.com/ClearskySec/status/960924755355369472"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.g0007","attack.t1059.003","attack.t1218.011","car.2013-10-002","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/APT28/proc_creation_win_apt_sofacy.yml","techniques":["T1059.003","T1218.011"],"cves":[]},{"id":"c048f047-7e2a-4888-b302-55f509d4a91d","title":"SCR File Write Event","author":"Christopher Peacock @securepeacock, SCYTHE @scythe_io","status":"test","level":"medium","date":"2022-04-27","modified":"2023-08-23","description":"Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an \".SCR\" file using \"rundll32.exe desk.cpl,InstallScreenSaver\" for example.","references":["https://lolbas-project.github.io/lolbas/Libraries/Desk/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/file/file_event/file_event_win_new_scr_file.yml","techniques":["T1218.011"],"cves":[]},{"id":"c3a99af4-35a9-4668-879e-c09aeb4f2bdf","title":"Rundll32 Execution With Uncommon DLL Extension","author":"Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou","status":"test","level":"medium","date":"2022-01-13","modified":"2024-04-04","description":"Detects the execution of rundll32 with a command line that doesn't contain a common extension","references":["https://twitter.com/mrd0x/status/1481630810495139841?s=12"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_uncommon_dll_extension.yml","techniques":["T1218.011"],"cves":[]},{"id":"caa06de8-fdef-4c91-826a-7f9e163eef4b","title":"RunDLL32 Spawning Explorer","author":"elhoim, CD_ROM_","status":"test","level":"high","date":"2022-04-27","modified":"2022-05-25","description":"Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way","references":["https://redcanary.com/blog/intelligence-insights-november-2021/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_spawn_explorer.yml","techniques":["T1218.011"],"cves":[]},{"id":"cdc8da7d-c303-42f8-b08c-b4ab47230263","title":"Rundll32 Internet Connection","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-11-04","modified":"2024-03-13","description":"Detects a rundll32 that communicates with public IP addresses","references":["https://www.hybrid-analysis.com/sample/759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6?environmentId=100"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.stealth","attack.t1218.011","attack.execution"],"path":"rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml","techniques":["T1218.011"],"cves":[]},{"id":"d465d1d8-27a2-4cca-9621-a800f37cf72e","title":"Equation Group DLL_U Export Function Load","author":"Florian Roth (Nextron Systems)","status":"stable","level":"critical","date":"2019-03-04","modified":"2023-03-09","description":"Detects a specific export function name used by one of EquationGroup tools","references":["https://github.com/00derp/EquationGroupLeak/search?utf8=%E2%9C%93&q=dll_u&type=","https://twitter.com/cyb3rops/status/972186477512839170"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.g0020","attack.t1218.011","detection.emerging-threats"],"path":"rules-emerging-threats/2019/TA/EquationGroup/proc_creation_win_apt_equationgroup_dll_u_load.yml","techniques":["T1218.011"],"cves":[]},{"id":"d7eb979b-c2b5-4a6f-a3a7-c87ce6763819","title":"Suspicious Control Panel DLL Load","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-04-15","modified":"2023-02-09","description":"Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits","references":["https://twitter.com/rikvduijn/status/853251879320662017","https://twitter.com/felixw3000/status/853354851128025088"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_susp_control_dll_load.yml","techniques":["T1218.011"],"cves":[]},{"id":"e593cf51-88db-4ee1-b920-37e89012a3c9","title":"Potentially Suspicious Rundll32 Activity","author":"juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2019-01-16","modified":"2023-05-17","description":"Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities","references":["http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/","https://twitter.com/Hexacorn/status/885258886428725250","https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52","https://twitter.com/nas_bench/status/1433344116071583746","https://twitter.com/eral4m/status/1479106975967240209","https://twitter.com/eral4m/status/1479080793003671557"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml","techniques":["T1218.011"],"cves":[]},{"id":"e79a9e79-eb72-4e78-a628-0e7e8f59e89c","title":"DLL Call by Ordinal Via Rundll32.EXE","author":"Florian Roth (Nextron Systems)","status":"stable","level":"medium","date":"2019-10-22","modified":"2024-07-16","description":"Detects calls of DLLs exports by ordinal numbers via rundll32.dll.","references":["https://web.archive.org/web/20200530031906/https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/","https://github.com/Neo23x0/DLLRunner","https://twitter.com/cyb3rops/status/1186631731543236608","https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_rundll32_by_ordinal.yml","techniques":["T1218.011"],"cves":[]},{"id":"e8a95b5e-c891-46e2-b33a-93937d3abc31","title":"Suspicious HH.EXE Execution","author":"Maxim Pavlunin","status":"test","level":"high","date":"2020-04-01","modified":"2023-04-12","description":"Detects a suspicious execution of a Microsoft HTML Help (HH.exe)","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.stealth","attack.t1047","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.007","attack.t1218","attack.t1218.001","attack.t1218.010","attack.t1218.011","attack.t1566","attack.t1566.001"],"path":"rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1059.007","T1218","T1218.001","T1218.010","T1218.011","T1566","T1566.001"],"cves":[]},{"id":"e98f741c-6a5b-4c83-bc2a-1f4e58d07b12","title":"Kapeka Backdoor Execution Via RunDLL32.EXE","author":"Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2024-07-03","modified":null,"description":"Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a \"-d\" argument.\n","references":["https://labs.withsecure.com/publications/kapeka","https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.011","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Malware/kapeka/proc_creation_win_malware_kapeka_backdoor_rundll32_execution.yml","techniques":["T1218.011"],"cves":[]},{"id":"f0b70adb-0075-43b0-9745-e82a1c608fcc","title":"ZxShell Malware","author":"Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro","status":"test","level":"critical","date":"2017-07-20","modified":"2021-11-27","description":"Detects a ZxShell start by the called and well-known function name","references":["https://www.hybrid-analysis.com/sample/5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16?environmentId=100","https://pub-7cb8ac806c1b4c4383e585c474a24719.r2.dev/116309e7121bc8b0e66e4166c06f7b818e1d3629.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.003","attack.t1218.011","attack.s0412","attack.g0001","detection.emerging-threats"],"path":"rules-emerging-threats/2014/TA/Axiom/proc_creation_win_apt_zxshell.yml","techniques":["T1059.003","T1218.011"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}