Rundll32 UNC Path Execution

Title: Rundll32 UNC Path Execution
Status: test
Description:Detects rundll32 execution where the DLL is located on a remote location (share). Threat actors can abuse the rundll32.exe binary to execute remote DLLs from a UNC pathh.
References:
  -https://www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code
  -https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-10
modified:2026-07-20
Tags:

• -'attack.execution'
• -'attack.lateral-movement'
• -'attack.stealth'
• -'attack.t1021.002'
• -'attack.t1218.011'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\rundll32.exe' OriginalFileName:'RUNDLL32.EXE' CommandLine|contains:'rundll32'   selection_cli:
    CommandLine|contains:
      -' \\\\'
      -' '\\\\'
      -' "\\\\'

  filter_main_cli_pipe:
    CommandLine|contains: '\\\\.\\pipe'
  condition:all of selection_* and not 1 of filter_main_*
Falsepositives:
  -Unlikely
Level: high