huntrule

Suspicious Rundll32 Copied to Startup Folder via Blister Loader

PremiumReviewedSigma · High · v1
Product
windows
Category
file_event
Author
HuntRule
Published
2026-10-15
Updated
2026-10-15
AnalysisDetection

ATT&CK techniques

Persistence → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a copy of rundll32.exe being written into the user Startup folder, a persistence technique used by the Blister loader which drops rundll32.exe alongside its own payload DLL to auto-run at logon. Placing a legitimate system binary outside System32 in a Startup path is a strong sign of DLL proxy execution being staged for persistence.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Suspicious Rundll32 Persistence via Registry Run Key (via registry_set)
Suspicious File Written to Startup Folder by DllHost COM Surrogate
Malicious Run Key Persistence miasma-monitor from AsyncAPI npm Compromise
Malicious Run Key Persistence NvmProtocal Launching NodePackages Payload
Suspicious Run Key Persistence Masquerading as Google Update
Suspicious Mint Sandstorm VBScript Persistence via Run Key (via registry_set)
Malicious Marbled Dust OMServerService VBScript Dropped to Startup Folder
Malicious STOCKSTAY Registry Run Key Persistence via MARKETMAKER Binaries (via registry_set)
Suspicious Registry Run Key Persistence Masquerading as Dropbox
Suspicious Rundll32 Copied to Startup Folder via Blister Loader
Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.