Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
615 detections
Filters
Last updated
All Time
Detection languages
267
188
49
39
27
Contributors
133
104
101
80
38
Categories
492
293
67
43
33
Platforms
610
3
2
1
1
Products / Services
186
147
144
45
12
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
3
3
2
2
IDS Classtypes
1
IDS Protocols
1
This rule detects attempts to coerce NTLM authentication on the Printer Spooler service, which can be used for privilege escalation. Specifically, it looks for `rundll32.exe` executing with command-line arguments related to `davclnt.dll,DavSetCookie` and keywords like `spoolss`, `srvsvc`, or `/print/pipe/`, indicating an NTLM relay attack against the print spooler service.
Detects potential abuse of "ShellDispatch.dll" functionality to execute arbitrary binaries via "ShellExecute" using rundll32.exe. This technique involves rundll32.exe being executed with a command line containing 'RunDll_ShellExecuteW'.
This rule detects suspicious execution of rundll32.exe when its parent process is control.exe, specifically excluding cases where 'Shell32.dll' is present in the command line. This behavior has been observed in attacks by the Equation Group and exploit kits to load malicious DLLs via the Control Panel process, often as a defense evasion technique.
Detects the execution of Rundll32.exe where the command line contains file extensions commonly associated with image files. This behavior is suspicious as Rundll32.exe is typically used to execute DLL functions, and its use with image file extensions can indicate an attempt to masquerade malicious DLLs or scripts as benign image files to evade detection.
Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations. This technique is often used by adversaries to evade security controls that monitor execution from standard system paths.
Detects the creation of potentially suspicious child processes by a ClickOnce application. Adversaries may abuse ClickOnce, a Microsoft deployment technology, to execute malicious code or binaries from a trusted source. This rule specifically looks for common Windows utilities and scripting engines being launched as child processes of a ClickOnce application, which could indicate an attempt to bypass security controls or execute further malicious actions.
Detects when 'DllRegisterServer' is called in the command line of a process that is not 'rundll32.exe'. This behavior is indicative of an adversary renaming the 'rundll32' utility to evade detection, while still leveraging its functionality to execute DLLs.
Detects suspicious child processes spawned by Windows Terminal (WindowsTerminal.exe or wt.exe). This rule identifies the execution of common Living Off The Land Binaries (LOLBins) like rundll32.exe, regsvr32.exe, certutil.exe, cscript.exe, wscript.exe, and csc.exe, as well as processes launched from suspicious user-controlled directories (e.g., Downloads, Desktop, Temp folders). Additionally, it flags command lines containing keywords often associated with malicious activity, such as PowerShell Invoke- and DownloadString, or common command shell execution parameters. This activity could indicate an adversary establishing persistence or executing malicious code via Windows Terminal.
This rule detects instances where 'rundll32.exe' initiates an outbound network connection to a public IP address. It filters out connections to common local, private, and Microsoft-owned IP ranges, as well as specific legitimate command lines and Azure internal hostnames, to reduce false positives. The rule aims to identify suspicious network activity originating from rundll32.exe, which is often abused by malware for defense evasion and execution.
This rule detects the execution of `rundll32.exe` with a DLL containing the exported function `StartNodeRelay`. This specific function is associated with F-Secure C3, a command and control framework. Detection indicates potential use of this tool for malicious purposes, likely for defense evasion and establishing C2 communications.
This rule detects the execution of rundll32.exe with command-line arguments indicative of Cobalt Strike's StartW function being used to load DLLs. Specifically, it looks for 'rundll32.exe' or 'rundll32 ' in the command line, along with a '.dll' file and either ' StartW' or ',StartW' as the ending argument. This behavior is commonly associated with Cobalt Strike for defense evasion and execution of malicious payloads.
Detects the execution of specific commands and DLLs associated with the RedMimicry Winnti playbook, an automated breach emulation utility. The rule looks for 'rundll32.exe' or 'cmd.exe' processes executing with command-line arguments containing 'gthread-3.6.dll', '\Windows\Temp\tmp.bat', or 'sigcmm-2.4.dll'. This indicates the use of specific tools and techniques employed by the Winnti threat group, as emulated by RedMimicry.
Detects the execution of an executable by calling the 'LaunchApplication' function from the 'pcwutl.dll' library via 'rundll32.exe'. This technique is often used for defense evasion to proxy execution of malicious code.
Detects the execution of 'rundll32.exe' when its parent process is 'explorer.exe'. This behavior has been observed in variants of the Raspberry Robin malware, as initially reported by Red Canary. The rule includes filters to reduce false positives from legitimate Windows operations, such as volume control.
This rule detects suspicious workstation locking activity initiated via rundll32.exe. Specifically, it looks for instances where rundll32.exe is the process image, its parent process is cmd.exe, and its command line contains both 'user32.dll,' and 'LockWorkStation'. This combination indicates an attempt to programmatically lock the workstation using a system binary proxy execution method, which can be abused by adversaries.
Detects the creation or modification of a registry key related to screen savers, specifically when `rundll32.exe` is used to set a screen saver executable (`SCRNSAVE.EXE`) to a `.scr` file, while excluding common legitimate system paths. This technique can be used by adversaries to establish persistence or execute malicious code through masqueraded screen saver files.
Detects obfuscated PowerShell execution attempts that leverage rundll32.exe and shell32.dll. The rule looks for specific keywords in the PowerShell module payload, such as '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll', combined with common PowerShell execution terms like 'value', 'invoke', 'comspec', or 'iex'. This combination suggests an attempt to bypass detection by using rundll32.exe to launch obfuscated PowerShell commands.
This rule detects obfuscated PowerShell execution launched via rundll32.exe. It specifically looks for PowerShell script block text containing 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell', which are indicators of the Invoke-Obfuscation framework's RUNDLL LAUNCHER technique. This method is often used for defense evasion and execution of malicious scripts.
Detects obfuscated PowerShell scripts that utilize rundll32.exe, shell32.dll, and shellexec_rundll to execute commands. The rule specifically looks for the presence of '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll' along with keywords like 'value', 'invoke', 'comspec', or 'iex' within PowerShell script block logs. This combination is indicative of techniques used for defense evasion and execution.
This rule detects the execution of rundll32.exe with command-line arguments indicative of loading registered COM objects. Specifically, it looks for `rundll32.exe` processes where the command line contains both `{-sta` or `-localserver` and curly braces (`{`, `}`). This pattern is often used by adversaries to achieve persistence or privilege escalation by hijacking COM objects and executing malicious code through them.
This rule detects suspicious activity involving rundll32.exe launching runonce.exe with setupapi.dll and the InstallHinfSection function. This technique can be used by adversaries to achieve persistence by modifying registry run keys or executing arbitrary code via INF files, as setupapi.dll's InstallHinfSection function can call runonce.exe regardless of the INF file's content.
Page 29 of 30