Suspicious Advpack Call Via Rundll32.EXE with Ordinal Obfuscation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

This rule detects suspicious execution of 'rundll32.exe' when it attempts to load 'advpack.dll' and specifically calls functions using an obfuscated ordinal number (e.g., '#12' or '#-'). This technique is often used by adversaries to leverage the 'RegisterOCX' function for defense evasion, as it can bypass security monitoring that might not scrutinize rundll32.exe's normal operations or direct DLL function calls.