attack.t1218.011

Suspicious Rundll32 Script in CommandLine

Dec 1, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects suspicious process related to rundll32 based on arguments

Rundll32 Execution Without DLL File

Nov 20, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects the execution of rundll32 with a command line that doesn't contain a .dll file

Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Nov 15, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.

NotPetya Ransomware Activity

Nov 10, 2023 · attack.defense_evasion attack.t1218.011 attack.t1070.001 attack.credential_access attack.t1003.001 car.2016-04-002 detection.emerging_threats ·

Share on:

Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil

Remote Thread Creation Via PowerShell In Potentially Suspicious Target

Nov 10, 2023 · attack.defense_evasion attack.execution attack.t1218.011 attack.t1059.001 ·

Share on:

Detects the creation of a remote thread from a Powershell process in a potentially suspicious target process

APT29 2018 Phishing Campaign CommandLine Indicators

Oct 18, 2023 · attack.execution attack.t1218.011 detection.emerging_threats ·

Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

CobaltStrike Load by Rundll32

Oct 18, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.

Equation Group DLL_U Export Function Load

Oct 18, 2023 · attack.g0020 attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detects a specific export function name used by one of EquationGroup tools

Potential Emotet Rundll32 Execution

Oct 18, 2023 · attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detecting Emotet DLL loading by looking for rundll32.exe processes with command lines ending in ,RunDLL or ,Control_RunDLL

Potential PowerShell Execution Via DLL

Oct 18, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects potential PowerShell execution from a DLL instead of the usual PowerShell process as seen used in PowerShdll

Potentially Suspicious Rundll32 Activity

Oct 18, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities

Rundll32 Internet Connection

Oct 18, 2023 · attack.defense_evasion attack.t1218.011 attack.execution ·

Share on:

Detects a rundll32 that communicates with public IP addresses

Sofacy Trojan Loader Activity

Oct 18, 2023 · attack.defense_evasion attack.execution attack.g0007 attack.t1059.003 attack.t1218.011 car.2013-10-002 detection.emerging_threats ·

Share on:

Detects Trojan loader activity as used by APT28

Process Access via TrolleyExpress Exclusion

Oct 17, 2023 · attack.defense_evasion attack.t1218.011 attack.credential_access attack.t1003.001 ·

Share on:

Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory

RunDLL32 Spawning Explorer

Oct 17, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way

Rundll32 UNC Path Execution

Oct 17, 2023 · attack.defense_evasion attack.execution attack.t1021.002 attack.t1218.011 ·

Share on:

Detects rundll32 execution where the DLL is located on a remote location (share)

Potential Bumblebee Remote Thread Creation

Oct 15, 2023 · attack.defense_evasion attack.execution attack.t1218.011 attack.t1059.001 detection.emerging_threats ·

Share on:

Detects remote thread injection events based on action seen used by bumblebee

SCR File Write Event

Sep 18, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example.

IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32

Sep 7, 2023 · attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". This behaviour was often seen used by malware and especially IcedID

ScreenSaver Registry Key Set

Aug 17, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl

Rundll32 InstallScreenSaver Execution

Jul 13, 2023 · attack.t1218.011 attack.defense_evasion ·

Share on:

An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver

APT29 2018 Phishing Campaign File Indicators

Jun 20, 2023 · attack.execution attack.t1218.011 detection.emerging_threats ·

Share on:

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

EvilNum APT Golden Chickens Deployment Via OCX Files

Jun 20, 2023 · attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report

Fireball Archer Install

Jun 20, 2023 · attack.execution attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detects Archer malware invocation via rundll32

Rhadamanthys Stealer Module Launch Via Rundll32.EXE

Jun 20, 2023 · attack.defense_evasion attack.t1218.011 detection.emerging_threats ·

Share on:

Detects the use of Rundll32 to launch an NSIS module that serves as the main stealer capability of Rhadamanthys infostealer, as observed in reports and samples in early 2023

ZxShell Malware

Jun 20, 2023 · attack.execution attack.t1059.003 attack.defense_evasion attack.t1218.011 attack.s0412 attack.g0001 detection.emerging_threats ·

Share on:

Detects a ZxShell start by the called and well-known function name

Rundll32 Application Bypass with DllRegisterServer Function (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects the DllRegisterServer export function implemented with Rundll32. Part of the RedCanary 2023 Threat Detection Report.

Rundll32 Injection into LSASS (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects instances where Rundll32 opens a cross process handle into LSASS to collect credentials. Part of the RedCanary 2023 Threat Detection Report.

Rundll32 Suspicious Process Lineage (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects instances of Rundll32 being spawned by unusual or suspicious parent processes. Part of the RedCanary 2023 Threat Detection Report.

Rundll32 Without a Command Line (RedCanary Threat Detection Report)

May 10, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects instances of Rundll32 without a command line spawning child processes. Part of the RedCanary 2023 Threat Detection Report.

Outbound Network Connection To Public IP Via Winlogon

Apr 28, 2023 · attack.defense_evasion attack.execution attack.command_and_control attack.t1218.011 ·

Share on:

Detects a "winlogon.exe" process that initiate network communications with public IP addresses

HTML Help HH.EXE Suspicious Child Process

Apr 12, 2023 · attack.defense_evasion attack.execution attack.initial_access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Suspicious HH.EXE Execution

Apr 12, 2023 · attack.defense_evasion attack.execution attack.initial_access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Suspicious Rundll32 Execution With Image Extension

Mar 17, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects the execution of Rundll32.exe with DLL files masquerading as image files

HackTool - F-Secure C3 Load by Rundll32

Mar 5, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

F-Secure C3 produces DLLs with a default exported StartNodeRelay function.

Suspicious Control Panel DLL Load

Mar 5, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits

HackTool - RedMimicry Winnti Playbook Execution

Mar 2, 2023 · attack.execution attack.defense_evasion attack.t1106 attack.t1059.003 attack.t1218.011 ·

Share on:

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

Shell32 DLL Execution in Suspicious Directory

Mar 2, 2023 · attack.defense_evasion attack.execution attack.t1218.011 ·

Share on:

Detects shell32.dll executing a DLL in a suspicious directory

Suspicious Call by Ordinal

Feb 21, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects suspicious calls of DLLs in rundll32.dll exports by ordinal

Suspicious Rundll32 Activity Invoking Sys File

Feb 21, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452

Suspicious Rundll32 Setupapi.dll Activity

Feb 21, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file.

Code Execution via Pcwutl.dll

Feb 9, 2023 · attack.defense_evasion attack.t1218.011 ·

Share on:

Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.

Application Bypass with RunDLL32 and DllRegisterServer Function

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 attack.s0650 attack.s0386 ·

Share on:

DLLs that are designed to be loaded by Regsvr32 are expected to have a DllRegisterServer export function implemented. This detects use of the same DLL to rundll32.exe. Inspired by the 2022 Red Canary Threat Detection report.

Rundll32 with Suspicious Export Functionalities

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 ·

Share on:

Detects instances of rundll32.exe running Windows native DLLs that have export functionalities that adversaries commonly leverage for executing malicious code and evading defensive controls. Inspired by the 2022 Red Canary Threat Detection report.

Rundll32 with Suspicious Process Lineage

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 ·

Share on:

Detects executions of rundll32.exe from unusual or suspicious parent processes. Inspired by the 2022 Red Canary Threat Detection report.

Rundll32 without Command Line

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 ·

Share on:

Detects instances of rundll32.exe with no command line that spawns a child process. Inspired by the 2022 Red Canary Threat Detection report.