Suspicious ShellExec_RunDLL Call Via Ordinal

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2025•0•12

Detects suspicious calls to the "ShellExec_RunDLL" exported function of SHELL32.DLL using an ordinal number to launch other commands. Adversaries might use ordinal numbers to bypass detections that rely on the function name in the command line. The rule looks for specific ordinal numbers associated with ShellExec_RunDLL and combines this with suspicious parent command-line arguments (e.g., containing 'comspec', 'iex', 'Invoke-', or paths like 'Temp') or suspicious child processes (e.g., bash, cmd, powershell, bitsadmin, msiexec).