Hide Navigation Hide TOC

Potentially Suspicious Rundll32.EXE Execution of UDL File (0ea52357-cd59-4340-9981-c46c7e900428)

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6)	Attack Pattern	Potentially Suspicious Rundll32.EXE Execution of UDL File (0ea52357-cd59-4340-9981-c46c7e900428)	Sigma-Rules	1
Potentially Suspicious Rundll32.EXE Execution of UDL File (0ea52357-cd59-4340-9981-c46c7e900428)	Sigma-Rules	Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5)	Attack Pattern	1
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5)	Attack Pattern	2