Rule Info
Name
Potentially Suspicious Rundll32.EXE Execution of UDL File
Author
@kostastsale
Description
Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file.
Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.
Date
2024-08-16 00:00:00
Modified
None
Id
0ea52357-cd59-4340-9981-c46c7e900428
Tags
attack.defense-evasion attack.execution attack.command-and-control attack.t1218.011 attack.t1071
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
github-actions[bot]
Merge PR #5506 from @nasbench -promote older rules status from `experimental` to `test`
2025-07-01
Kostas
Merge PR #4974 from @tsale - Add `Potentially Suspicious Rundll32.EXE Execution of UDL File`
2024-08-16
Scan your endpoints, forensic images or collected files with our portable scanner THOR