Sigma rule: Potential Obfuscated Ordinal Call Via Rundll32

Rule

Title

Potential Obfuscated Ordinal Call Via Rundll32

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2023-05-17

Modified

2025-02-23

File

rules/windows/process_creation/proc_creation_win_rundll32_obfuscated_ordinal_call.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of "rundll32" with potential obfuscated ordinal calls

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\rundll32.exe'
    - OriginalFileName: 'RUNDLL32.EXE'
    - CommandLine|contains: 'rundll32'
selection_cli:
    CommandLine|contains:
        - '#+'
        - '#-'
        # ordinal can be represented by adding any number of zeros in front ordinal number, for e.g. 000000024
        - '#0'
        # ordinal is 16 bit ordinal, so if you make the number large enough (don't fit in 16 bit space), then it normally wraps around.
        # for e.g ordinal 24 can be also represented by 65560 (65536+24)
        - '#655'
        - '#656'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1027.010

MITRE ATT&CK ids this rule names

• T1027.010

References

• Internal Research
• https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_rundll32_obfuscated_ordinal_call.yml