T1218.011 Rundll32 — Detection Rules

Source-backed rule directory

• Remote Thread Creation Via PowerShell In Uncommon Target · test · medium · {"product":"windows","category":"create_remote_thread"}
• SCR File Write Event · test · medium · {"category":"file_event","product":"windows"}
• Unsigned DLL Loaded by Windows Utility · test · medium · {"product":"windows","category":"image_load"}
• Rundll32 Internet Connection · test · medium · {"category":"network_connection","product":"windows"}
• Outbound Network Connection To Public IP Via Winlogon · test · medium · {"category":"network_connection","product":"windows"}
• Process Access via TrolleyExpress Exclusion · test · high · {"category":"process_creation","product":"windows"}
• HTML Help HH.EXE Suspicious Child Process · test · high · {"category":"process_creation","product":"windows"}
• Suspicious HH.EXE Execution · test · high · {"category":"process_creation","product":"windows"}
• HackTool - F-Secure C3 Load by Rundll32 · test · critical · {"category":"process_creation","product":"windows"}
• CobaltStrike Load by Rundll32 · test · high · {"category":"process_creation","product":"windows"}
• HackTool - RedMimicry Winnti Playbook Execution · test · high · {"product":"windows","category":"process_creation"}
• Code Execution via Pcwutl.dll · test · medium · {"category":"process_creation","product":"windows"}
• Rundll32 InstallScreenSaver Execution · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Rundll32 Setupapi.dll Activity · test · medium · {"category":"process_creation","product":"windows"}
• Shell32 DLL Execution in Suspicious Directory · test · high · {"category":"process_creation","product":"windows"}
• RunDLL32 Spawning Explorer · test · high · {"category":"process_creation","product":"windows"}
• Potentially Suspicious Rundll32 Activity · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Control Panel DLL Load · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Rundll32 Execution With Image Extension · test · high · {"category":"process_creation","product":"windows"}
• Suspicious ShellExec_RunDLL Call Via Ordinal · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Rundll32 Activity Invoking Sys File · test · high · {"category":"process_creation","product":"windows"}
• Potentially Suspicious Rundll32.EXE Execution of UDL File · test · medium · {"category":"process_creation","product":"windows"}
• Rundll32 UNC Path Execution · test · high · {"category":"process_creation","product":"windows"}
• Rundll32 Execution With Uncommon DLL Extension · test · medium · {"category":"process_creation","product":"windows"}
• Bad Opsec Defaults Sacrificial Processes With Improper Arguments · test · high · {"category":"process_creation","product":"windows"}
• Potential PowerShell Execution Via DLL · test · high · {"category":"process_creation","product":"windows"}
• ScreenSaver Registry Key Set · test · medium · {"product":"windows","category":"registry_set"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0475 Detection Strategy for T1218.011 Rundll32 Abuse

AN1308 Analytic 1308

Detects rundll32.exe invoked with atypical arguments (.dll, .cpl, javascript:, mshtml). DLLs not normally loaded by rundll32 are mapped into memory. Control_RunDLL or RunHTMLApplication invoked. Suspicious DLLs or scripts accessed from disk or network. Rundll32 reaches out to external domains (e.g., fetching .sct or .hta).