SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,621 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver
Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity
Detects execution of "rundll32" with potential obfuscated ordinal calls
Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspberry Robin, as first reported by Red Canary.
setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file.
Detects potential "ShellDispatch.dll" functionality abuse to execute arbitrary binaries via "ShellExecute"
Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way
Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits
Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack
Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452
Page 137 of 680