Detection rules › Splunk

Rundll32 with no Command Line Arguments with Network

Author
Steven Dick, Michael Haag, Splunk
Source
upstream

The following analytic detects the execution of rundll32.exe without command line arguments, followed by a network connection. This behavior is identified using Endpoint Detection and Response (EDR) telemetry and network traffic data. It is significant because rundll32.exe typically requires arguments to function, and its absence is often associated with malicious activity, such as Cobalt Strike. If confirmed malicious, this activity could indicate an attempt to establish unauthorized network connections, potentially leading to data exfiltration or further compromise of the system.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1218.011 System Binary Proxy Execution: Rundll32

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon3Network connection

Stages and Predicates

Stage 1: tstats

tstats WHERE (Processes.original_file_name="RUNDLL32.EXE" OR Processes.process_name="rundll32.exe") Processes.process IN ("*rundll32", "*rundll32.exe", "*rundll32.exe\"") BY _time, host, Processes.action, Processes.dest, Processes.original_file_name, Processes.parent_process, Processes.parent_process_exec, Processes.parent_process_guid, Processes.parent_process_id, Processes.parent_process_name, Processes.parent_process_path, Processes.process, Processes.process_exec, Processes.process_guid, Processes.process_hash, Processes.process_id, Processes.process_integrity_level, Processes.process_name, Processes.process_path, Processes.user, Processes.user_id, Processes.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: rename

rename

Stage 6: join

join type=inner (...)

Stage 7: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
All_Traffic.dest_portne
  • 0 corpus 6 (splunk 6)
Processes.original_file_nameeq
  • RUNDLL32.EXE corpus 28 (sigma 25, splunk 3)
Processes.processin
  • "*rundll32"
  • "*rundll32.exe"
  • "*rundll32.exe\""
Processes.process_nameeq
  • rundll32.exe corpus 3 (splunk 3)