Detection rules › Sigma

Potentially Suspicious Rundll32.EXE Execution of UDL File

Severity
medium
Author
@kostastsale
Source
upstream

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1218.011 System Binary Proxy Execution: Rundll32
Command & ControlT1071 Application Layer Protocol

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_parent

ParentImage|endswith: '\explorer.exe'

Stage 2: all of selection_img

or:
Image|endswith: '\rundll32.exe'
OriginalFileName: RUNDLL32.EXE

Stage 3: all of selection_cli

CommandLine|endswith: .udl
CommandLine|contains: ',OpenDSLFile '
CommandLine|contains: '\\Users\\*\\Downloads\\'
CommandLine|contains: oledb32.dll

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLineends_with
  • .udl
CommandLinematch
  • ,OpenDSLFile
  • \\Users\\*\\Downloads\\
  • oledb32.dll
Imageends_with
  • \rundll32.exe corpus 76 (sigma 76)
OriginalFileNameeq
  • RUNDLL32.EXE corpus 28 (sigma 25, splunk 3)
ParentImageends_with
  • \explorer.exe corpus 11 (sigma 11)