Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
615 detections
Filters
Last updated
All Time
Detection languages
267
188
49
39
27
Contributors
133
104
101
80
38
Categories
492
293
67
43
33
Platforms
610
3
2
1
1
Products / Services
186
147
144
45
12
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
3
3
2
2
IDS Classtypes
1
IDS Protocols
1
This analytic detects the execution of the rundll32.exe command with the user32.dll,LockWorkStation parameter. This specific command is used to lock the workstation via the command line, which is an uncommon method. This activity has been observed in CONTI ransomware tooling for defense evasion purposes. If confirmed malicious, this technique could indicate an attempt to evade detection and hinder incident response efforts.
The following analytic detects the execution of rundll32.exe with the `Control_RunDLL` command, loading files from world-writable directories such as windows\temp, programdata, or appdata. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process command-line data and specific directory paths. This activity is significant as it may indicate an attempt to exploit CVE-2021-40444 or similar vulnerabilities, allowing attackers to execute arbitrary code. If confirmed malicious, this could lead to unauthorized code execution, privilege escalation, or persistent access within the environment.
This analytic detects instances where the `rundll32.exe` process creates new executable (`.exe`) or dynamic link library (`.dll`) files. This behavior is identified by monitoring Sysmon EventCode 11 (FileCreate). `rundll32.exe` is a legitimate Windows utility, but it is frequently abused by adversaries to execute malicious code, establish persistence, or escalate privileges. Malware families like IcedID are known to leverage `rundll32.exe` to drop payloads in common user-writable directories such as `Temp`, `AppData`, or `ProgramData`. Detecting this activity can indicate the presence of malicious software attempting to deploy its components.
The following analytic identifies the execution of the rundll32.exe process with the "plugininit" parameter. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant because the "plugininit" parameter is commonly associated with IcedID malware, which uses it to execute an initial DLL stager to download additional payloads. If confirmed malicious, this behavior could lead to further malware infections, data exfiltration, or complete system compromise.
The analytic detects `rundll32.exe` loading a DLL export function by ordinal value. This behavior is significant because adversaries may use `rundll32.exe` to execute malicious code while evading security tools that do not monitor this process. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to system compromise, privilege escalation, or persistent access within the environment.
This rule detects the execution of 'rundll32.exe' with command-line arguments that suggest an obfuscated ordinal call. Ordinal calls are a way to execute functions within a DLL by their numerical index rather than their name. Adversaries may obfuscate these ordinal numbers by adding leading zeros or using large numbers that wrap around due to 16-bit integer limitations, making the command line harder to analyze and potentially bypassing signature-based detections.
This rule detects the execution of rundll32.exe with a command line that does not specify a common DLL extension (.cpl, .dll, .inf). Adversaries often use rundll32.exe to execute malicious code, and by using uncommon or no extensions, they attempt to evade detection mechanisms that might look for standard rundll32.exe usage. The rule filters out known legitimate uses of rundll32.exe, such as those involving common extensions, local server invocations, MSIExec processes, and specific Microsoft EdgeUpdate processes.
Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity. The rule looks for rundll32.exe being spawned by common scripting or execution processes (cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, wscript.exe) and executing a file in common temporary or user-writable directories (ProgramData, Users\Public, Windows\Installer, AppData\Local\Temp, AppData\Roaming) where the file being executed does not have a standard DLL, CPL, or INF extension.
Detects the execution of a Control Panel (.CPL) file located in the user's temporary directory via the Shell32 DLL's "Control_RunDLL" export function. This behavior has been observed in multiple Raspberry Robin malware variants.
Detects the execution of rundll32.exe that leads to an external network connection, specifically looking for known processes used by the Pikabot malware family for command and control (C2) communication. This rule identifies suspicious network activity originating from rundll32.exe when its parent process is one of the specified Windows binaries, which Pikabot has been observed to hijack for C2.
Detects the execution of a binary that has been renamed from its original name, often used by attackers or malware for defense evasion. This rule leverages the Sysmon 'OriginalFileName' datapoint to identify instances where common Windows utilities or attacker tools are executed under a different filename.
This rule detects the creation of a remote thread by a PowerShell process (powershell.exe or pwsh.exe) into specific target processes, namely rundll32.exe or regsvr32.exe. This activity is often indicative of defense evasion and execution techniques used by adversaries to inject malicious code or achieve persistence by leveraging legitimate system binaries.
Detects specific process creation patterns associated with UNC2452 (SolarWinds Compromise) activity, as identified by Microsoft Defender ATP queries. This includes the use of 7-Zip for archiving, wscript.exe executing VBS scripts, and rundll32.exe for DLL execution, often involving specific command-line arguments and parent-child relationships.
Detects the use of rundll32.exe to launch an NSIS (Nullsoft Scriptable Install System) module, specifically looking for 'nsis_uns' and 'PrintUIEntry' in the command line. This behavior has been observed in the Rhadamanthys infostealer, where rundll32.exe is used to execute its main stealer capability.
This rule detects the use of potentially suspicious keywords within PowerShell scripts that are often associated with exploitation frameworks or advanced attack techniques. Specifically, it looks for reflection-related keywords like 'System.Reflection.Assembly.Load', '[System.Reflection.Assembly]::Load', '[Reflection.Assembly]::Load', 'System.Reflection.AssemblyName', 'Reflection.Emit.AssemblyBuilderAccess', 'Reflection.Emit.CustomAttributeBuilder', and keywords related to interop services and process manipulation such as 'Runtime.InteropServices.UnmanagedType', 'Runtime.InteropServices.DllImportAttribute', 'SuspendThread', and 'rundll32'. These keywords can indicate attempts to load assemblies in-memory, interact with unmanaged code, or manipulate processes, which are common tactics used by malware and red teaming tools.
Detects updates to scheduled tasks (EventID 4702) where the new task content (`TaskContentNew`) contains suspicious keywords. These keywords include common temporary or user-writable directories often used by malware for staging or execution, combined with suspicious commands or scripting interpreters. This rule aims to identify adversaries establishing persistence or executing malicious code via scheduled tasks.
Detects command-line indicators associated with the APT29 (Cozy Bear) 2018 phishing campaign, specifically looking for PowerShell execution with '-noni -ep bypass' and the presence of 'cyzfc.dat' and 'PointFunctionCall' in the command line. These indicators are linked to the group's methods for executing malicious code and potentially bypassing security measures.
Detects suspicious scheduled task creation events by analyzing the task content for unusual paths (e.g., temporary directories, user-writable locations) and the presence of commonly abused command-line utilities or scripting interpreters. This rule aims to identify persistence or execution mechanisms leveraging scheduled tasks.
Detects the creation of suspicious child processes by 'scrcons.exe' (Script Event Consumer). 'scrcons.exe' is a legitimate Windows component used for WMI event handling, but its spawning of common scripting interpreters, proxy execution binaries, or task schedulers can indicate malicious activity, often related to persistence or execution techniques leveraging WMI.
Detects suspicious child processes spawned by WmiPrvSE.exe, which is often abused by adversaries for execution and defense evasion. The rule specifically looks for common Living Off The Land Binaries (LOLBINs) and scripting interpreters being launched by WmiPrvSE, including certutil, cscript, mshta, msiexec, regsvr32, rundll32, verclsid, wscript, and cmd.exe with specific command-line arguments related to scripting or LOLBINs.
Detects various process execution behaviors associated with the Lazarus Group, including attempts to dump SAM registry hive, network connection enumeration using netstat, network share discovery patterns, persistence mechanisms involving common program data directories, and rundll32 execution with specific file extensions.
Page 26 of 30