Sigma rule: DLL Call by Ordinal Via Rundll32.EXE

Rule

Title

DLL Call by Ordinal Via Rundll32.EXE

Status

stable

Level

medium

Author

Florian Roth (Nextron Systems)

Date

2019-10-22

Modified

2024-07-16

File

rules-threat-hunting/windows/process_creation/proc_creation_win_rundll32_by_ordinal.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects calls of DLLs exports by ordinal numbers via rundll32.dll.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\rundll32.exe'
    - OriginalFileName: 'RUNDLL32.EXE'
selection_cli:
    CommandLine|contains:
        - ',#'
        - ', #'
        - '.dll #'  # Sysmon removes , in its log
        - '.ocx #'  # HermeticWizard
filter_optional_edge:
    CommandLine|contains|all:
        - 'EDGEHTML.dll'
        - '#141'
filter_optional_vsbuild_dll:
    ParentImage|contains:
        - '\Msbuild\Current\Bin\'
        - '\VC\Tools\MSVC\'
        - '\Tracker.exe'
    CommandLine|contains:
        - '\FileTracker32.dll,#1'
        - '\FileTracker32.dll",#1'
        - '\FileTracker64.dll,#1'
        - '\FileTracker64.dll",#1'
condition: all of selection_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• False positives depend on scripts and administrative tools used in the monitored environment.
• Windows control panel elements have been identified as source (mmc).

Tags

• attack.stealth
• attack.t1218.011
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1218.011

References

• https://web.archive.org/web/20200530031906/https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/
• https://github.com/Neo23x0/DLLRunner
• https://twitter.com/cyb3rops/status/1186631731543236608
• https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_creation/proc_creation_win_rundll32_by_ordinal.yml