Windows rundll32 Trojan Loader Execution via Local AppData and .dat Parameters
Flags rundll32.exe launched with AppData/local .dat and .dll patterns consistent with Trojan loader behavior.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2018-03-01
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where rundll32.exe is invoked with command-line paths under %LOCALAPPDATA% / AppData\Local\ and includes .dat/.dll parameters typical of a Trojan loader. Attackers use this behavior to load additional code from user-writable locations while blending into legitimate Windows execution patterns. The detection relies on process creation telemetry capturing the Image path and full command line, and it excludes executions that include AppData\Local\Temp\ to reduce obvious benign activity.
Reporting behind it
- researchcenter.paloaltonetworks.comhttps://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/
- hybrid-analysis.comhttps://www.hybrid-analysis.com/sample/ff808d0a12676bfac88fd26f955154f8884f2bb7c534b9936510fd6296c543e8?environmentId=110
- twitter.comhttps://twitter.com/ClearskySec/status/960924755355369472
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/APT28/proc_creation_win_apt_sofacy.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows rundll32 Trojan Loader Execution via Local AppData and .dat Parameters
id: 91bc1a60-b0de-42b7-962b-c693687045e3
status: test
description: This rule flags Windows process creation where rundll32.exe is invoked with command-line paths under %LOCALAPPDATA% / AppData\Local\ and includes .dat/.dll parameters typical of a Trojan loader. Attackers use this behavior to load additional code from user-writable locations while blending into legitimate Windows execution patterns. The detection relies on process creation telemetry capturing the Image path and full command line, and it excludes executions that include AppData\Local\Temp\ to reduce obvious benign activity.
references:
- https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/
- https://www.hybrid-analysis.com/sample/ff808d0a12676bfac88fd26f955154f8884f2bb7c534b9936510fd6296c543e8?environmentId=110
- https://twitter.com/ClearskySec/status/960924755355369472
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/APT28/proc_creation_win_apt_sofacy.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2018-03-01
modified: 2023-05-31
tags:
- attack.execution
- attack.stealth
- attack.g0007
- attack.t1059.003
- attack.t1218.011
- car.2013-10-002
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_path:
Image|endswith: \rundll32.exe
CommandLine|contains:
- "%LOCALAPPDATA%"
- \AppData\Local\
selection_extensions:
- CommandLine|contains: .dat",
- CommandLine|endswith:
- ".dll #1"
- '.dll" #1'
- .dll",#1
filter_main_exclude_temp:
CommandLine|contains: \AppData\Local\Temp\
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: ba778144-5e3d-40cf-8af9-e28fb1df1e20
type: derived