{"id":"c3a99af4-35a9-4668-879e-c09aeb4f2bdf","title":"Rundll32 Execution With Uncommon DLL Extension","description":"Detects the execution of rundll32 with a command line that doesn't contain a common extension","author":"Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou","status":"test","level":"medium","date":"2022-01-13","modified":"2024-04-04","tags":["attack.stealth","attack.t1218.011"],"technique_ids":["T1218.011"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/mrd0x/status/1481630810495139841?s=12"],"source_path":"rules/windows/process_creation/proc_creation_win_rundll32_uncommon_dll_extension.yml","source_sha256":"f4b6687f3e7d0a16bb8a40abd89a8e1079fe06214c802abce4247d9cea031416","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_uncommon_dll_extension.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Rundll32 Execution With Uncommon DLL Extension\nid: c3a99af4-35a9-4668-879e-c09aeb4f2bdf\nstatus: test\ndescription: Detects the execution of rundll32 with a command line that doesn't contain a common extension\nreferences:\n    - https://twitter.com/mrd0x/status/1481630810495139841?s=12\nauthor: Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou\ndate: 2022-01-13\nmodified: 2024-04-04\ntags:\n    - attack.stealth\n    - attack.t1218.011\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n    filter_main_null:\n        CommandLine: null\n    filter_main_empty:\n        CommandLine: ''\n    filter_main_known_extension:\n        - CommandLine|contains:\n              # Note: This aims to cover: single and double quotes in addition to spaces and comma \",\" usage.\n              - '.cpl '\n              - '.cpl,'\n              - '.cpl\"'\n              - \".cpl'\"\n              - '.dll '\n              - '.dll,'\n              - '.dll\"'\n              - \".dll'\"\n              - '.inf '\n              - '.inf,'\n              - '.inf\"'\n              - \".inf'\"\n        - CommandLine|endswith:\n              # Note: This aims to cover: single and double quotes in addition to spaces and comma \",\" usage.\n              - '.cpl'\n              - '.dll'\n              - '.inf'\n    filter_main_localserver:\n        CommandLine|contains: ' -localserver '\n    filter_main_zzzzInvokeManagedCustomActionOutOfProc:\n        ParentImage|endswith: '\\msiexec.exe'\n        CommandLine|contains|all:\n            - ':\\Windows\\Installer\\'\n            - '.tmp'\n            - 'zzzzInvokeManagedCustomActionOutOfProc'\n    filter_optional_EdgeUpdate:\n        ParentCommandLine|contains|all:\n            - ':\\Users\\'\n            - '\\AppData\\Local\\Microsoft\\EdgeUpdate\\Install\\{'\n            - '\\EDGEMITMP_'\n            - '.tmp\\setup.exe'\n            - '--install-archive='\n            - '--previous-version='\n            - '--msedgewebview --verbose-logging --do-not-launch-msedge --user-level'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218.011","id":"T1218.011","name":"Rundll32","page":"techniques/enterprise/T1218.011/"}],"data_path":"data/detection-rules/c3a99af4-35a9-4668-879e-c09aeb4f2bdf.json","kind":"sigma"}