Every published rule

Windows Rundll32 Execution of Ammy Admin Agent DLL

Identifies rundll32 executions that invoke the Ammy Admin agent DLL with a run parameter on Windows.

Windows Security Event 4698: Kapeka-like Scheduled Task Creation

Flags suspicious Kapeka-like scheduled task creation via Event 4698 using TaskContent paths, rundll32/.wll command markers, and OneDrive/Sens Api task names.

Windows Registry Run Key Autorun Entries Targeting Kapeka Backdoor

Flags Windows Run key registry changes whose data matches a Kapeka-style rundll32 .wll (#1) autorun entry.

Kapeka backdoor execution via rundll32.exe with export ordinal #1 and -d on Windows

Flags rundll32.exe command lines launching a Kapeka payload from ProgramData/AppData Local using export ordinal #1 with "-d".

Windows Kapeka Backdoor Persistence via schtasks ONSTART or Run Registry Autorun

Flags Windows persistence creation for Kapeka using schtasks (ONSTART) or Run registry entries plus rundll32 ordinal-based execution.

Windows: Kapeka backdoor DLL (.wll) loaded via rundll32.exe

Flags rundll32.exe loading a suspicious .wll backdoor from ProgramData or AppData\Local.

Suspicious Child Process of KeyScrambler.exe on Windows

Alerts on KeyScrambler.exe launching cmd.exe, PowerShell, script hosts, regsvr32, or rundll32 as child processes.

Windows Process Creation: rundll32 Shell32 Control_RunDLL Executes .CPL from User Temp

Detects rundll32 Shell32 Control_RunDLL launching a .CPL from user Temp, a stealthy execution path.

Windows Utility Loads Unsigned DLL (ImageLoad)

Flags DLL loads by InstallUtil/RegAsm/RegSvcs/regsvr32/rundll32 when the loaded DLL is unsigned or untrusted.

Windows: Suspicious rundll32 Execution of Non-DLL Extension via Living-off-the-Land Parent Processes

Flags rundll32.exe executions from common script parents where the command line references known drop locations but lacks standard extensions.

Windows Process Execution: Suspicious cmd.exe Command-Line Combinations (Pikabot-like)

Alerts on cmd.exe /c command chains containing download/delay and rundll32 indicators consistent with Pikabot-like staging.

Windows Process Creation: rundll32 Spawns Pikabot-Like Hollowing Binaries

Alerts when rundll32.exe spawns specific Windows binaries in patterns consistent with potential process hollowing.

Windows Process Creation Signals for Pikabot System Discovery

Flags process-launch discovery commands (ipconfig/netstat/whoami) under rundll32 and Search host parent processes on Windows.

Windows rundll32.exe calling DllRegisterServer from a non-standard DLL path

Detects rundll32.exe calling DllRegisterServer from command lines associated with non-standard DLL locations.

Suspicious Child Process Spawned by Diskshadow.exe (Windows Process Creation)

Alerts on process creation where Diskshadow.exe spawns certutil, cscript, mshta, PowerShell, regsvr32, rundll32, or wscript.

Suspicious rundll32 Single-Digit DLL Execution with DllRegisterServer on Windows

Flags rundll32.exe running 1.dll with DllRegisterServer, a pattern seen in suspicious DLL execution.

Windows Browser-Injected rundll32 Execution Indicative of GuLoader Activity

Flags rundll32.exe being launched from a browser process, matching GuLoader-style injected browser execution behavior on Windows.

Windows rundll32.exe Using ShellExecute via ShellDispatch.dll Functionality

Alerts on rundll32.exe command lines referencing RunDll_ShellExecuteW, suggesting ShellDispatch.dll ShellExecute-based execution.

Windows: Detect Loading amsi.dll by LOLBIN Processes

Alert on amsi.dll DLL loads initiated by ExtExport.exe, Odbcconf.exe, or Rundll32.exe on Windows.

Windows Rundll32 Execution via Suspicious DLL Path Without .dll Extension

Alerts when rundll32.exe is started from suspicious parent scripts with a DLL-like path missing the .dll extension.