Sigma rule: Suspicious ShellExec_RunDLL Call Via Ordinal

Rule

Title

Suspicious ShellExec_RunDLL Call Via Ordinal

Status

test

Level

high

Author

Swachchhanda Shrawan Poudel

Date

2024-12-01

File

rules/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_ordinal_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands.
Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.

Log source

product

windows

category

process_creation

Detection

selection_parent_img:
    ParentCommandLine|contains: 'SHELL32.DLL'
selection_parent_ordinal:
    ParentCommandLine|contains:
        # Note: The ordinal number may differ depending on the DLL version
        # Example: rundll32 SHELL32.DLL,#572 "cmd.exe" "/c calc.exe"
        - '#568'
        - '#570'
        - '#572'
        - '#576'
selection_susp_cli_parent:
    # Note: Add additional binaries and suspicious paths to increase coverage
    - ParentCommandLine|contains:
          - 'comspec'
          - 'iex'
          - 'Invoke-'
          - 'msiexec'
          - 'odbcconf'
          - 'regsvr32'
    - ParentCommandLine|contains:
          - '\Desktop\'
          - '\ProgramData\'
          - '\Temp\'
          - '\Users\Public\'
selection_susp_child_img:
    Image|endswith:
        - '\bash.exe'
        - '\bitsadmin.exe'
        - '\cmd.exe'
        - '\cscript.exe'
        - '\curl.exe'
        - '\mshta.exe'
        - '\msiexec.exe'
        - '\msxsl.exe'
        - '\odbcconf.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\regsvr32.exe'
        - '\schtasks.exe'
        - '\wmic.exe'
        - '\wscript.exe'
condition: all of selection_parent_* and 1 of selection_susp_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1218.011

MITRE ATT&CK ids this rule names

• T1218.011

Related rules

• d87bd452-6da1-456e-8155-7dc988157b7d (derived)

References

• https://redcanary.com/blog/raspberry-robin/
• https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
• https://github.com/SigmaHQ/sigma/issues/1009
• https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_ordinal_execution.yml