huntrule

Suspicious Scheduled Task Running rundll32 DllRegisterServer Every Minute

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-05-05
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects creation of a scheduled task that repeatedly invokes rundll32 against the DllRegisterServer export on a per-minute trigger. OysterLoader uses this technique to persist a malicious DLL dropped into the user profile. A minute interval task launching rundll32 with DllRegisterServer is rarely legitimate and typically indicates loader persistence.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Suspicious Persistence via pcalua Launching rundll32 Control_RunDLL
Suspicious Scheduled Task Creation Running DLL from ProgramData
Suspicious DanaBot Updater Scheduled Task Running Rundll32 from AppData via schtasks
Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)
Agent Tesla Persistence via Realtek Named Scheduled Task Batch
Suspicious Scheduled Task Creation Named test3 by Salt Typhoon
Suspicious MeshAgent Persistence via Scheduled Task MeshUserTask (via process_creation)
Malicious PureMiner Persistence Executable in AppData HResult Folder
Suspicious Kimsuky Scheduled Task Impersonating Google Update CGI (via process_creation)
Suspicious Scheduled Task Running rundll32 DllRegisterServer Every Minute
Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.