Rundll32 Remote UNC DLL Ordinal Execution

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: "Rundll32 Remote UNC DLL Ordinal Execution"

# MITRE ATT&CK technique IDs
mitre_ids:
  - "T1218.011"
  - "T1105"

# Description of what the query does and its purpose.
description: "Detects rundll32 loading a DLL from a remote UNC path and invoking an export by ordinal, a proxy-execution pattern used to run remote code."

# The author or team that created the query.
author: "slapopotamus"

# The required log sources to run this query successfully in Next-Gen SIEM.
log_sources:
  - Endpoint

# Tags for filtering and categorization.
tags:
  - Detection

cs_required_modules:
  - Insight

# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
cql: |
  // OVERVIEW: Detects rundll32 loading a DLL from a remote UNC path and
  // invoking an export by ordinal, a proxy-execution pattern used to run remote code.
  // SOURCE HUNTPACK: EtherHiding ClickFix Hunt
  // MITRE: T1218.011, T1105
  // CONF: high | FP: low | COST: low
  // REQUIRES: ProcessRollup2
  // FALSE POSITIVES: Approved software deployment tooling using DLLs from network shares.
  // TUNING: Exclude validated deployment shares, distribution hosts, and known command lines.
  // LOOKBACK: 7d - set with the Falcon time picker.
  #event_simpleName=ProcessRollup2
  | FileName=/^rundll32(\.exe)?$/i
  // UNC host, optionally with WebDAV @port / @SSL suffixes (\\host\ , \\host@80\ , \\host@SSL\)
  | CommandLine=/\\\\[a-z0-9._\-]+(@[a-z0-9]+)*\\/i
  | CommandLine=/,#[0-9]+/i
  | table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine])
  | sort(@timestamp, order=desc, limit=500)

# Explanation of the query. Uses markdown for formatting on the webpage.
explanation: |
  This query detects a low-frequency signed-binary proxy-execution pattern in which `rundll32.exe` loads a DLL from a remote UNC path and invokes an export by ordinal.

  Source: [EtherHiding ClickFix HuntPack](https://slapopotamus.github.io/HuntPack/hunts/EtherHiding-ClickFix-Hunt.html).

  1. **Select process creation telemetry**: `#event_simpleName=ProcessRollup2`
     - Searches Falcon process events for executed programs and their command lines.

  2. **Identify rundll32 execution**: `FileName=/^rundll32(\.exe)?$/i`
     - Restricts results to the Windows signed binary used to load and execute DLL exports.

  3. **Require a remote UNC path**: `CommandLine=/\\\\[a-z0-9._\-]+(@[a-z0-9]+)*\\/i`
     - Finds command lines that reference a DLL or share hosted on a remote system. The optional `@…` group also matches WebDAV-style hosts such as `\\host@80\` and `\\host@SSL\`, which are how the ClickFix/GULoader variants deliver the DLL.

  4. **Require ordinal-based invocation**: `CommandLine=/,#[0-9]+/i`
     - Selects rundll32 command lines that invoke an export by numeric ordinal rather than by name.

  5. **Return investigation context**: `table(...)` and `sort(...)`
     - Presents the host, user, parent process, and complete command line with the newest events first.

  **False positives and tuning:** Some enterprise deployment systems legitimately load DLLs from network shares. Validate the remote host, share, parent process, file signature, and deployment change record before excluding activity. Limit exclusions to approved distribution hosts and reviewed command-line patterns.

  **Limitations:** The query identifies suspicious execution behavior, not a confirmed compromise. It requires command-line telemetry and only detects UNC paths written with a hostname or address after the leading double backslash (including WebDAV `@port` / `@SSL` forms). Paths built at runtime from environment variables or string concatenation are not visible in the command line and will not match.