Sigma rule: Rundll32.EXE Calling DllRegisterServer Export Function Explicitly

Rule

Title

Rundll32.EXE Calling DllRegisterServer Export Function Explicitly

Status

test

Level

medium

Author

Andreas Braathen (mnemonic.io)

Date

2023-10-17

File

rules-threat-hunting/windows/process_creation/proc_creation_win_rundll32_dllregisterserver.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when the DLL export function 'DllRegisterServer' is called in the commandline by Rundll32 explicitly where the DLL is located in a non-standard path.

Log source

product

windows

category

process_creation

Detection

selection_image:
    - Image|endswith: '\rundll32.exe'
    - OriginalFileName: 'RUNDLL32.EXE'
selection_cmdline:
    CommandLine|contains: 'DllRegisterServer'
filter_main_legit_paths:
    CommandLine|contains:
        - ':\Program Files (x86)'
        - ':\Program Files\'
        - ':\Windows\System32\'
        - ':\Windows\SysWOW64\'
condition: all of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate usage as part of application installation, but less likely from e.g. temporary paths.
• Not every instance is considered malicious, but this rule will capture the malicious usages.

Tags

• attack.stealth
• attack.t1218
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1218

Related rules

• 2569ed8c-1147-498a-9b8c-2ad3656b10ed (similar)

References

• https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
• https://www.virustotal.com/gui/file/94816439312563db982cd038cf77cbc5ef4c7003e3edee86e2b0f99e675ed4ed/behavior
• https://learn.microsoft.com/en-us/windows/win32/api/olectl/nf-olectl-dllregisterserver

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_creation/proc_creation_win_rundll32_dllregisterserver.yml