Rundll32.exe spawns conhost.exe

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detector Tags	LOLBIN Execution Analytics
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	System Binary Proxy Execution: Rundll32 (T1218.011)
Severity	Medium

Description

This unusual parent-child process relationship may indicate that an attacker has abused rundll32.exe to run a console-based application such as PowerShell.

Attacker's Goals

Evading detections by running code from a signed Microsoft executable.

Investigative actions

Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.