Suspicious Rundll32 Setupapi.dll Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects suspicious activity involving rundll32.exe launching runonce.exe with setupapi.dll and the InstallHinfSection function. This technique can be used by adversaries to achieve persistence by modifying registry run keys or executing arbitrary code via INF files, as setupapi.dll's InstallHinfSection function can call runonce.exe regardless of the INF file's content.