Detection of Rundll32 Execution via DLL Ordinals

Adversaries frequently utilize the native Windows utility rundll32.exe to execute arbitrary code. A specific technique involves calling an exported function within a DLL by its ordinal number rather than its name. This method is effective for evasion because many security tools and analysts focus on function names when performing static analysis or monitoring command-line arguments. By referencing the ordinal (e.g., rundll32.exe some.dll,#1), the attacker can successfully load and execute malicious payloads while remaining inconspicuous. This behavior has been observed in various campaigns, including those involving the IcedID malware. Defending against this requires deep visibility into process execution and command-line telemetry to identify suspicious patterns of rundll32.exe usage.

Impact

Successful execution of this technique allows for arbitrary code execution, which can lead to full system compromise, privilege escalation, or the establishment of persistent access. This is a common TTP observed across numerous threat actor campaigns targeting Windows environments for malware deployment and post-exploitation activity.

Recommendation

Detection engineering teams should focus on identifying process creation events where rundll32.exe command lines contain ordinal references.

• Deploy the provided Sigma rule to capture rundll32.exe processes containing the '#' character followed by digits in the command line.
• Enable Sysmon Event ID 1 or Windows Event Log Security 4688 to ensure full command-line visibility.
• Tune the detection by filtering against known-good binaries or third-party applications that legitimately utilize ordinal exports for compatibility.