RunDLL32.exe monitoring

Hypothesis and description

Adversaries may find it necessary to use Dyanamic-link Libraries (DLLs) to evade defenses. One way these DLLs can be "executed" is through the use of the built-in Windows utility RunDLL32, which allows a user to execute code in a DLL, providing the name and optional arguments to an exported entry point. Windows uses RunDll32 legitimately in its normal operation, but with a proper baseline and understanding of the environment, monitoring its usage could be fruitful.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2014-03-28
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1218 System Binary Proxy ExecutionT1218.011	Stealth (formerly Defense Evasion)	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1218System Binary Proxy Execution
.011 Rundll32

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

When looking for all instances of RunDLL32, it is imperative to also have the command_line information, which contains the DLL information, including the name, entry point, and optional arguments.

process = search Process:Create
rundll32 = filter process where (exe == "rundll32.exe")
output rundll32

DNIFData model: Sysmon native

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=rundll32.exe limit 100

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image="*\rundll32.exe"

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

28 more in the full list

View CAR-2014-03-006 on car.mitre.org

TTPCAR-2014-03-006