heroui logo

Rundll32 Execution Without Parameters

Sigma Rules

View Source
Summary
The rule titled 'Rundll32 Execution Without Parameters' is designed to detect instances of the Windows process rundll32.exe being executed without any parameters, a behavior that is unusual and potentially indicative of malicious activity such as lateral movement or exploitation attempts, particularly in the context of known attack techniques like those associated with Metasploit's psexec module. The significance of this detection lies in the fact that while rundll32.exe can be legitimately invoked without parameters, doing so is rare and often points to misuse or exploitation by attackers. This particular detection caters to the process creation log source in a Windows environment and monitors specific criteria in the command line arguments of executed processes. It raises a high-level alert when the command line only contains 'rundll32.exe' or 'rundll32', thus enabling security teams to investigate potentially nefarious activities, such as unauthorized remote command execution on systems.
Categories
  • Endpoint
  • Windows
Data Sources
  • Process
Created: 2021-01-31