Sigma high test sigma

Rundll32 UNC Path Execution

Detects rundll32 execution where the DLL is located on a remote location (share). Threat actors can abuse the rundll32.exe binary to execute remote DLLs from a UNC pathh.

View Source

Detection Logic

{
  "selection_img": [
    {
      "Image
| endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    },
    {
      "CommandLine
| contains": "rundll32"
    }
  ],
  "selection_cli": {
    "CommandLine
| contains": [
      " \\\\\\\\",
      " '\\\\\\\\",
      " \"\\\\\\\\"
    ]
  },
  "filter_main_cli_pipe": {
    "CommandLine
| contains": "\\\\\\\\.\\\\pipe"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...