Detection rules › Sigma

Suspicious Rundll32 Execution With Image Extension

Severity
high
Author
Hieu Tran
Source
upstream

Detects the execution of Rundll32.exe with DLL files masquerading as image files

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1218.011 System Binary Proxy Execution: Rundll32

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_img

or:
Image|endswith: '\rundll32.exe'
OriginalFileName: RUNDLL32.exe

Stage 2: all of selection_cli

or:
CommandLine|contains: .bmp
CommandLine|contains: .cr2
CommandLine|contains: .eps
CommandLine|contains: .gif
CommandLine|contains: .ico
CommandLine|contains: .jpeg
CommandLine|contains: .jpg
CommandLine|contains: .nef
CommandLine|contains: .orf
CommandLine|contains: .png
CommandLine|contains: .raw
CommandLine|contains: .sr2
CommandLine|contains: .tif
CommandLine|contains: .tiff

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • .bmp corpus 2 (sigma 2)
  • .cr2
  • .eps
  • .gif corpus 6 (sigma 6)
  • .ico
  • .jpeg corpus 6 (sigma 6)
  • .jpg corpus 7 (sigma 7)
  • .nef
  • .orf
  • .png corpus 7 (sigma 7)
  • .raw
  • .sr2
  • .tif
  • .tiff
Imageends_with
  • \rundll32.exe corpus 76 (sigma 76)
OriginalFileNameeq
  • RUNDLL32.exe corpus 3 (sigma 3)