Unusual Child Processes of RunDLL32

  1[metadata]
  2creation_date = "2020/09/02"
  3integration = ["endpoint", "windows", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies a no-argument or malformed Rundll32 launch followed by child process execution. This unusual sequence can
 11indicate Rundll32 abuse for proxy execution or payload handoff.
 12"""
 13from = "now-60m"
 14index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "logs-crowdstrike.fdr*"]
 15interval = "30m"
 16language = "eql"
 17license = "Elastic License v2"
 18name = "Unusual Child Processes of RunDLL32"
 19risk_score = 73
 20rule_id = "f036953a-4615-4707-a1ca-dc53bf69dcd5"
 21severity = "high"
 22tags = [
 23    "Domain: Endpoint",
 24    "OS: Windows",
 25    "Use Case: Threat Detection",
 26    "Tactic: Defense Evasion",
 27    "Data Source: Elastic Defend",
 28    "Data Source: Sysmon",
 29    "Data Source: Crowdstrike",
 30    "Resources: Investigation Guide",
 31    "Noise: Low",
 32    "Performance: Normal",
 33    "Profile: Recommended",
 34    "Threat: Living off the Land",
 35    "Rule Type: Event Correlation (EQL)",
 36    "Platform: Windows",
 37]
 38type = "eql"
 39
 40query = '''
 41sequence with maxspan=1h
 42  [process where host.os.type == "windows" and event.type == "start" and
 43     (process.name : "rundll32.exe" or process.pe.original_file_name == "RUNDLL32.EXE") and
 44      (process.args_count == 1 and
 45        /* Excludes bug where a missing closing quote sets args_count to 1 despite extra args */
 46        not process.command_line regex~ """\".*\.exe[^\"].*""")
 47  ] by process.entity_id
 48  [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "rundll32.exe"
 49  ] by process.parent.entity_id
 50'''
 51
 52note = """## Triage and analysis
 53
 54### Investigating Unusual Child Processes of RunDLL32
 55
 56#### Possible investigation steps
 57
 58- Which source events define the no-argument "rundll32.exe" parent and the spawned child?
 59  - Why: this asymmetric sequence has no single safe process identity; recover source events before interpreting grouped meaning or pivoting.
 60  - Focus: Timeline source events for the sequence, recording parent and child `process.entity_id`, child `process.parent.entity_id`, `host.id`, and `user.id`.
 61  - Implication: escalate when recovered events show one no-argument "rundll32.exe" handing off to an unexpected child; lower suspicion only when recovery shows a parser/quoting artifact and the child is signed, stable, and path-consistent for the same user and host.
 62
 63- Does the recovered "rundll32.exe" event truly lack a DLL, export, or Control_RunDLL-style target?
 64  - Why: normal Rundll32 proxy execution names a DLL/export, ordinal, script target, or Control Panel handler; this rule covers empty or malformed invocation that still spawns a child.
 65  - Focus: parent `process.command_line`, `process.args_count`, `process.executable`, and `process.pe.original_file_name`.
 66  - Implication: escalate when `process.args_count` and `process.command_line` confirm only the image path or a malformed target; lower suspicion only when source recovery proves a quoting/parser artifact and the exact parent-child command pattern is stable.
 67
 68- What did the recovered child process do, and does its identity fit that parent chain?
 69  - Focus: child `process.executable`, `process.command_line`, `process.pe.original_file_name`, code signature, and descendant process starts.
 70  - Hint: after recovering the child `process.entity_id` from source events, pivot manually on that ID for descendants; the final sequence alert may not preserve a child-specific entity ID.
 71  - Implication: escalate when the child is a shell, script host, network utility, unsigned payload, user-writable binary, or mismatched original file name; lower suspicion when the child is signed, path-consistent, and matches the exact recovered wrapper pattern. Identity alone does not clear the behavior.
 72
 73- What launched "rundll32.exe", and does the user-host context explain the handoff?
 74  - Focus: parent `process.parent.executable`, `process.parent.command_line`, `process.Ext.ancestry`, `user.name`, and `user.domain`.
 75  - Implication: escalate when the launcher is Office, a browser, archive utility, script host, temp-path executable, or a lineage unusual for that `user.id` and `host.id`; lower suspicion only when the same parent executable, command line, child path, signer, and host/user scope recur without artifact or network contradictions.
 76
 77- If library telemetry is available after source-event recovery, did the recovered process load a hidden or recently staged DLL?
 78  - Focus: library events for recovered `host.id` and each `process.entity_id`, checking `dll.path`, `dll.hash.sha256`, signer, trust, and `dll.Ext.relative_file_creation_time`.
 79  - Hint: query library events separately for the recovered parent and child IDs; missing library telemetry limits DLL corroboration but does not clear the process evidence.
 80  - Implication: escalate when a DLL loads from a user-writable, unrelated, unsigned, or recently created path; lower suspicion when library identity, signer, and path relationship fit the recovered parent-child workflow.
 81
 82- If file or network telemetry is available after source-event recovery, did the chain stage payloads or reach suspicious infrastructure?
 83  - Focus: file and network events for recovered `host.id` and each `process.entity_id`, checking `file.path`, `file.Ext.windows.zone_identifier`, DNS `dns.question.name`, connection `destination.ip`, and `destination.port`.
 84  - Hint: separate DNS lookup events from connection events before interpreting them. Missing network telemetry is unresolved, not benign.
 85  - Implication: escalate when the chain writes executable or scriptable artifacts, carries internet provenance, or connects to rare external infrastructure; lower suspicion when optional activity stays inside the recovered parent-child workflow.
 86
 87- If local evidence remains suspicious or unresolved, do related alerts show the same user, host, or child-process pattern?
 88  - Focus: recent alerts for `user.id`, `host.id`, child `process.executable`, child `process.hash.sha256`, or a distinctive `process.command_line` fragment.
 89  - Hint: use only after source recovery keeps the case suspicious or unresolved.
 90    - $investigate_0
 91    - $investigate_1
 92  - Implication: broaden response when the same user or host repeats Rundll32 proxy-execution, child payload, or related defense-evasion alerts; keep scope local when the suspicious pattern remains isolated and the recovered workflow is tightly explained.
 93
 94- Escalate when source recovery, invocation shape, child identity, launcher lineage, DLL/file/network evidence, or recurrence shows "rundll32.exe" proxying unauthorized child execution or payload delivery; close only when recovered process evidence and corroborators tightly bind one exact signed workflow on this host; if evidence is mixed or incomplete, preserve artifacts and escalate.
 95
 96### False positive analysis
 97
 98- No-argument "rundll32.exe" spawning a child is an operational anti-pattern. Close as benign only when source recovery proves a parser/quoting artifact or authorized reproduction, the child is signed and path-consistent, and no DLL, file, or network evidence contradicts that workflow. Align available inventory, vendor, or test records; otherwise treat prior recurrence for the same `host.id` and stable parent-child anchors as supporting evidence only.
 99- Build exceptions from the minimum confirmed workflow: parent `process.parent.executable`, child `process.executable`, stable `process.code_signature.subject_name`, command-line shape, host/user scope, and recovered artifact anchors when present. Do not except a first occurrence, unresolved source recovery, missing contradictory-telemetry checks, or "rundll32.exe" alone.
100
101### Response and remediation
102
103- If confirmed benign:
104  - Reverse temporary containment and document the recovered parent-child workflow, source-event IDs, signer, command-line pattern, and corroborating inventory, vendor record, or recurrence that established it.
105- If suspicious but unconfirmed:
106  - Preserve a case export of Timeline source events, recovered process identifiers and command lines, child binary hash, and any recovered DLL, file, or network artifacts before cleanup.
107  - Apply reversible containment such as temporary network restrictions or heightened monitoring on the affected `host.id` and `user.id`; use host isolation only when child-process or artifact evidence indicates active payload execution and the host role can tolerate isolation.
108- If confirmed malicious:
109  - Preserve the recovered source events, process IDs, command lines, child hashes, DLL or file artifacts, and network indicators, then isolate the host or restrict the account based on the child execution, launcher lineage, artifact, or network evidence.
110  - Block confirmed malicious child hashes, DLL hashes, staged payload paths, domains, and destination IPs, then review other hosts and users for the same parent-child or artifact pattern before eradication.
111  - Remove only the malicious DLLs, scripts, or child payloads identified during investigation, remediate the parent launcher or delivery path that invoked "rundll32.exe", and investigate credential exposure if follow-on behavior suggests collection or lateral movement.
112- Post-incident hardening:
113  - Keep process telemetry for "rundll32.exe" and child processes enabled, and enable file, network, or library telemetry where missing evidence limited the case.
114  - Restrict unusual "rundll32.exe" child-process patterns where the business does not require them, and record any adjacent DLL/export, ordinal, Control Panel, or script-target variants observed in the case.
115"""
116
117setup = """## Setup
118
119This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
120
121Setup instructions: https://ela.st/install-elastic-defend
122
123### Additional data sources
124
125This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
126
127- [CrowdStrike](https://ela.st/crowdstrike-integration)
128- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
129"""
130
131[rule.investigation_fields]
132field_names = [
133    "@timestamp",
134    "host.name",
135    "host.id",
136    "user.id",
137    "event.category",
138    "event.type",
139]
140
141[transform]
142
143[[transform.investigate]]
144label = "Alerts associated with the user"
145description = ""
146providers = [
147  [
148    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
149    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
150  ]
151]
152relativeFrom = "now-48h/h"
153relativeTo = "now"
154
155[[transform.investigate]]
156label = "Alerts associated with the host"
157description = ""
158providers = [
159  [
160    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
161    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
162  ]
163]
164relativeFrom = "now-48h/h"
165relativeTo = "now"
166
167[[rule.threat]]
168framework = "MITRE ATT&CK"
169[[rule.threat.technique]]
170id = "T1218"
171name = "System Binary Proxy Execution"
172reference = "https://attack.mitre.org/techniques/T1218/"
173[[rule.threat.technique.subtechnique]]
174id = "T1218.011"
175name = "Rundll32"
176reference = "https://attack.mitre.org/techniques/T1218/011/"
177
178[rule.threat.tactic]
179id = "TA0005"
180name = "Defense Evasion"
181reference = "https://attack.mitre.org/tactics/TA0005/"