high Sigma Windows

Rundll32 Without an Export, Making a Network Connection

rundll32.exe invoked with no export name and then opening an outbound socket. Normal usage always names an export; this shape is proxied execution.

Rule source

rundll32-no-ordinal-network.yml

title: Rundll32 Executing Without an Export and Making a Network Connection
id: 6ad02f18-7c94-4b3e-a5d1-90ef2c6b4478
status: stable
description: >
  rundll32.exe launched without a DLL export argument, then opening an outbound
  connection. Normal rundll32 usage always names an export; this shape is
  typical of proxied execution and DLL-based loaders.
references:
  - https://attack.mitre.org/techniques/T1218/011/
author: DetectionOps
date: 2026/09/05
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\rundll32.exe'
  filter_has_export:
    CommandLine|contains:
      - ','
      - '#'
  filter_empty:
    CommandLine: null
  condition: selection and not 1 of filter_*
fields:
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Control panel applets invoked with shell32 shortcuts
  - Printer and driver installers that call rundll32 with a path only
level: high
tags:
  - attack.defense_evasion
  - attack.t1218.011

Required telemetry

Sysmon - Event ID 1 and 3 (process creation, network connect)

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Control panel applets launched from shell shortcuts
Printer and driver installers that pass a path with no ordinal

Validation

Atomic Red Team T1218.011-1, plus a signed loader replay in the detonation lab

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.