Potential Obfuscated Ordinal Call Via Rundll32 — Sigma Rule

Rule metadata and linked tags

Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems). Source status: test; severity: medium. Source dates: 2023-05-17 / 2025-02-23.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: a0a4c687a6a17ba4fa01860a0629422cfa37659744cfb52b4fd64376cb5c6e5d

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Potential Obfuscated Ordinal Call Via Rundll32
id: 43fa5350-db63-4b8f-9a01-789a427074e1
status: test
description: Detects execution of "rundll32" with potential obfuscated ordinal calls
references:
    - Internal Research
    - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2023-05-17
modified: 2025-02-23
tags:
    - attack.stealth
    - attack.t1027.010
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\rundll32.exe'
        - OriginalFileName: 'RUNDLL32.EXE'
        - CommandLine|contains: 'rundll32'
    selection_cli:
        CommandLine|contains:
            - '#+'
            - '#-'
            # ordinal can be represented by adding any number of zeros in front ordinal number, for e.g. 000000024
            - '#0'
            # ordinal is 16 bit ordinal, so if you make the number large enough (don't fit in 16 bit space), then it normally wraps around.
            # for e.g ordinal 24 can be also represented by 65560 (65536+24)
            - '#655'
            - '#656'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• Internal Research (source note; no public URL supplied)
• https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s