Cobalt Strike DLL Load via Rundll32 StartW

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

This rule detects the execution of rundll32.exe with command-line arguments indicative of Cobalt Strike's StartW function being used to load DLLs. Specifically, it looks for 'rundll32.exe' or 'rundll32 ' in the command line, along with a '.dll' file and either ' StartW' or ',StartW' as the ending argument. This behavior is commonly associated with Cobalt Strike for defense evasion and execution of malicious payloads.