Potential Obfuscated Ordinal Call Via Rundll32

Rule Info

Tags
attack.defense_evasion DEMO
Name
Potential Obfuscated Ordinal Call Via Rundll32
Id
43fa5350-db63-4b8f-9a01-789a427074e1
Date
2023-05-17 00:00:00
Modified
None
Description
Detects execution of "rundll32" with potential obfuscated ordinal calls
Reference
Internal Research
Author
Nasreddine Bencherchali (Nextron Systems)
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=43fa5350-db63-4b8f-9a01-789a427074e1

Rule History

Title
Author
Commit
Date
feat: multiple updates and new rules (#4242)
Nasreddine Bencherchali
62caac470
2023-05-17
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022