RunDLL32 with Unusual Arguments
Description
Identifies unusual instances of RunDLL32 with suspicious keywords or paths in the process command line value. Adversaries may abuse rundll32.exe to proxy execution of malicious code.
Query · eql
process where event.action == "start" and process.name : "rundll32.exe" and
(
/* suspicious extensions and paths */
(process.command_line : "*\\AppData\\Local\\Temp\\*,*" and not process.command_line : "*.dll*") or
process.command_line :
("*.jpg*,*",
"*.png*,*",
"*.gif*,*",
"*.bmp*,*",
"*.jpeg*,*",
"*.TIFF*,*",
"*.tmp*,*",
"*.dat*,*",
"*.txt*,*",
"* ?:/*/*",
"* ..\\*",
"*:\\Users\\Public\\*,*",
"*:\\Users\\*\\Documents\\*,*",
"*:\\Users\\*\\Pictures\\*,*",
"*:\\Users\\*\\Music\\*,*",
"*:\\Windows\\Tasks\\*,*",
"*:\\Windows\\System32\\tasks\\*,*",
"*:\\Documents and Settings\\*,*",
"*\\@SSL\\DavWWWRoot\\*",
/* Issue #371 */
"*.bin,*",
"*.log,*",
"*.nki,*",
"*\\M?-*.dll,_run@*",
"*%TEMP%\\*.cpl*",
"*\\Users\\*\\Downloads\\*.cpl*",
"*\\appdata\\roaming\\microsoft\\templates\\*,*",
/* DLL exec by ordinal */
"* #*", "*,#*") or
process.command_line like "*rUNdlL32.eXe*" or
/* fake Control_RunDLL export */
(process.command_line : "*Control_RunDLL*" and not process.command_line : "*shell32.dll*Control_RunDLL*") or
/* delayed execution */
(process.parent.name : "cmd.exe" and process.parent.args : ("timeout", "ping", "choice") and process.parent.args : ("/nobreak", "/n", "/t")) or
/* execution from temp with suspicious parent process tree */
(process.command_line : "*\\AppData\\Local\\Temp\\*" and process.parent.name : ("wscript.exe", "cscript.exe", "wmiprvse.exe")) or
/* suspicious parent powershell args */
(process.parent.name : "powershell.exe" and
process.parent.args : ("-enc", "IEX", "*wp-content*", "*wp-admin*", "*wp-includes*", "*$*$*$*$*$*", "*^*^*^*^*^*^*^*^*^*", "*.replace*") and
not (process.args : "UpdatePerUserSystemParameters" and process.args : "USER32.DLL"))
)
/* False Positives */
and not
process.command_line :
("*JOBID=*",
"*davclnt.dll,DavSetCookie*",
"*PhotoViewer*ImageView_Fu*",
"*url.dll,FileProtocolHandler*",
"*zzzzInvokeManagedCustomActionOutOfProc*",
"*,DeferredDelete*",
"*:\\WINDOWS\\system32\\spool\\*",
"*:\\Program Files (x86)\\*",
"*:\\Program Files\\*",
/* Issue #282 - FP */
"*cryptext*CryptExt*",
"*dfshim.dll*ShOpenVerbShortcut*",
"*\\Documents\\DocuShare\\*",
/* Issue #371 */
"*ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile*",
"*FirewallControlPanel.dll,ShowNotificationDialog*",
"*--type=renderer*--log-file=*",
"*--lang=*--log-file=*",
"*--type=gpu-process*--user-data-dir=*",
"*--type=gpu-process*--enable-chrome-runtime*",
"*--type=gpu-process*--use-gl=*",
"*shell32*OpenAs_RunDLL*",
"*dfshim*ShOpenVerbExtension*",
"*printui*PrintUIEntry*",
"*mshtml*PrintHTML*",
"*shell32*#44*",
"*shell32.dll*ShellExec_RunDLL*#*",
"*EDGEHTML*#*"
) and not
(process.command_line : "*.tmp*" and
process.parent.executable : ("?:\\Windows\\System32\\msiexec.exe", "?:\\Windows\\SysWOW64\\msiexec.exe") and
process.parent.args : "-Embedding") and
not process.args : "?:\\ProgramData\\Parallels\\RASLogs\\tmp*.tmp,StopMemshell" and
not (process.args : "?:\\Users\\Public\\IBM\\ClientSolutions\\Start_Programs\\Windows_*\\acsnative.dll*" and
process.parent.executable : "?:\\Users\\Public\\IBM\\ClientSolutions\\Start_Programs\\Windows_*\\acslaunch_*.exe") and
not process.parent.executable :
("?:\\Program Files\\Common Files\\BullGuardInstall\\BullGuard*.exe",
"?:\\Program Files (x86)\\Intuit\\QuickBooks 20??\\QBW??.EXE",
"?:\\Program Files\\Intuit\\QuickBooks 2022\\QBW.EXE",
"C:\\Users\\Public (x86)\\Spectra\\temp\\smsx.exe") and
not (user.name : "user" and process.args : "file.dll,#*") and
not (process.name : "rundll32.exe" and process.args : "uxtheme.dll,#64" and process.args : "?:\\WINDOWS\\Resources\\Themes\\*") and
not process.parent.executable :
("?:\\Program Files\\NVIDIA Corporation\\*.exe",
"?:\\Program Files (x86)\\Windows Media Components\\Encoder\\wmstypelib.exe",
"?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AdobeCollabSync.exe") and
not (process.name : "rundll32.exe" and
process.args : ("dfshim.dll,ShArpMaintain",
"?:\\WINDOWS\\SYSTEM32\\MSHTML.dll,#125",
"dfshim.dll,ShOpenVerbApplication",
"?:\\WINDOWS\\System32\\shimgvw.dll,ImageView_PrintTo",
"?:\\Windows\\System32\\DriverStore\\FileRepository\\*",
"?:\\Windows\\system32\\hotplug.dll,HotPlugSafeRemovalDriveNotification",
"c:\\EWDK??\\Program Files\\Microsoft Visual Studio\\*,#1",
"?:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper32.dll,#1",
"?:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper64.dll,#1",
"C:\\Users\\Public\\IBM\\ClientSolutions\\Start_Programs\\Windows_x86-64\\acsnative.dll,",
"C:\\Windows\\TEMP\\*.tmp\\uninshlp.dll,DeleteExeAndDeleteSelf",
"?:\\Users\\*\\AppData\\Local\\Temp\\ns*.tmp\\BgInstallAssist.dll,RunDll_*",
"?:\\WINDOWS\\Installer\\MSI*.tmp*")) and
not (process.name : "rundll32.exe" and
process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\ns*.tmp\\*" and
process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\ns*.tmp") and
not (process.parent.executable : "?:\\Program Files*\\Splashtop\\Splashtop Remote\\Client for STB\\strwinclt.exe" and
process.args : "?:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper64.dll,#1") and
not (process.name : "rundll32.exe" and process.command_line : "\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Users\\*\\AppData\\Local\\Temp\\GLF*.tmp\",RunDll32_KillDTG" and
process.parent.name : "BelMonitor.exe") and
not process.command_line : "rundll32.exe \"C:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper??.dll\",#1" and
not (process.parent.code_signature.subject_name == "IDS Imaging Development Systems GmbH" and process.parent.code_signature.trusted == true) and
not (process.parent.code_signature.subject_name == "Feitian Technologies Co., Ltd." and process.parent.code_signature.trusted == true)