Command Shell Activity Started via RunDLL32

Attackers commonly abuse RunDLL32 to execute malicious code by proxying command shell execution. This technique allows attackers to bypass application control and execute arbitrary commands. This activity typically involves rundll32.exe spawning cmd.exe or powershell.exe. Defenders need to monitor for this activity, especially when unexpected DLLs or functions are being executed, as this can indicate malicious intent. This activity has been observed across multiple environments where adversaries attempt to gain a foothold or execute commands discreetly.

Attack Chain

1. The attacker gains initial access to the system through an existing vulnerability or compromised credentials.
2. The attacker uses RunDLL32 to execute a malicious DLL. rundll32.exe <path_to_dll>,<export_name>
3. The malicious DLL contains code to execute a command shell.
4. RunDLL32 spawns a command shell (cmd.exe or powershell.exe).
5. The command shell executes commands specified by the attacker.
6. The attacker performs reconnaissance activities, such as gathering system information or network configurations using ipconfig or whoami commands executed within the spawned shell.
7. The attacker attempts lateral movement by using the command shell to access other systems on the network.
8. The attacker achieves their final objective, such as data exfiltration or establishing persistence.

Impact

Successful exploitation allows attackers to execute arbitrary commands, potentially leading to credential compromise, data theft, or system compromise. The impact is typically limited to the privileges of the user account under which the command shell is running, but can lead to domain compromise if a privileged account is targeted.

Recommendation

• Monitor process creation events for cmd.exe or powershell.exe with rundll32.exe as the parent process, excluding known legitimate uses (rule: "Detect Command Shell Activity Started via RunDLL32").
• Inspect the command-line arguments of rundll32.exe processes to identify any suspicious or unusual DLLs or functions being executed.
• Deploy the Sigma rules in this brief to your SIEM and tune for your environment.
• Enable Sysmon process-creation logging to activate the rules above.