Rundll32 Execution Without Parameters — Sigma Rule

Rule metadata and linked tags

Author: Bartlomiej Czyz, Relativity. Source status: test; severity: high. Source dates: 2021-01-31 / 2023-02-28.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 04e109f6784ecf1cb9245c2d44375603b06fd49da339e0d5e13d88503d422b41

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Rundll32 Execution Without Parameters
id: 5bb68627-3198-40ca-b458-49f973db8752
status: test
description: Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module
references:
    - https://bczyz1.github.io/2021/01/30/psexec.html
author: Bartlomiej Czyz, Relativity
date: 2021-01-31
modified: 2023-02-28
tags:
    - attack.lateral-movement
    - attack.t1021.002
    - attack.t1570
    - attack.execution
    - attack.t1569.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine:
            - 'rundll32.exe'
            - 'rundll32'
    condition: selection
falsepositives:
    - False positives may occur if a user called rundll32 from CLI with no options
level: high

Original YAML and metadata in JSON

False positives

• False positives may occur if a user called rundll32 from CLI with no options

Source references

• https://bczyz1.github.io/2021/01/30/psexec.html