title: Suspicious Rundll32 Script in CommandLine
id: 73fcad2e-ff14-4c38-b11d-4172c8ac86c7
status: experimental
description: Detects suspicious process related to rundll32 based on arguments
author: frack113
references:
  - https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
date: 2021/12/04
logsource:
  category: process_creation
  product: windows
detection:
  selection_run:
    CommandLine|contains|all:
      - rundll32
      - 'mshtml,RunHTMLApplication'
  selection_script:
    CommandLine|contains:
      - 'javascript:'
      - 'vbscript:'
  condition: all of selection_*
falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored environment
level: medium
tags:
  - attack.defense_evasion
  - attack.t1218.011 
