Sigma detection rules, expert-reviewed

Malicious DLL Execution With Non Standard Extension via rundll32

This rule detects rundll32.exe loading a library renamed with a .db extension which the DPRK aligned Stressed Pungsan npm campaign uses to masquerade its downloaded payload package.db and execute an exported function while evading extension based detection.

Andromeda Loader Execution via Rundll32 Desktop.ini Ordinal

This rule detects rundll32.exe invoking a DLL export _ldr together with a desktop.ini argument, the loader launch pattern of the Andromeda Gamarue cluster. Using rundll32 to call an obscure loader ordinal while referencing desktop.ini is a distinctive execution and evasion behavior.

Suspicious rundll32 Execution of sqlite3 DLL by Ordinal with TLB Argument

This rule detects rundll32 loading a sqlite3 DLL by ordinal export #138 together with an x64.tlb argument, the loader invocation used by the Winnti arsenal in Operation CuckooBees. Attackers disguise the malicious payload as a legitimate sqlite3 library and pass a type-library file to trigger execution. This precise ordinal-and-tlb combination is a high-confidence Winnti loader indicator.

Malicious Zardoor Backdoor Execution via rundll32 (via process_creation)

This rule detects rundll32.exe invoking the MainEntry export of zar32.dll or zor32.dll, the core execution modules of the Zardoor backdoor. These components provide command-and-control and reverse-proxy capability during long-term espionage operations.

Suspicious Browser History Wipe via Rundll32 ClearMyTracksByProcess (via process_creation)

This rule detects rundll32.exe invoking InetCpl.cpl ClearMyTracksByProcess to clear browser history and cache as used by the HiddenGh0st malware to remove traces. This indicator flag combination erases stored browsing artifacts on the host.

Malicious Office Application Loading a User-Path DLL via Regsvr32 or Rundll32 (via process_creation)

This rule detects a Microsoft Office application spawning regsvr32 or rundll32 to load a DLL from a user-writable path such as AppData, Temp or ProgramData, the macro-driven loader pattern used by families like Emotet to execute their payload after a malicious document is opened. This document-to-DLL execution chain is documented in the Red Canary Threat Detection Report. Detecting the Office-to-DLL proxy execution surfaces the intrusion at the initial-access boundary.

Malicious Rundll32 Loading an Export From a User Path (via process_creation)

This rule detects rundll32.exe executing a named or ordinal export from a DLL located in AppData, ProgramData or Temp, the execution behavior IcedID and Bumblebee use to run a downloaded loader. Rundll32 export execution from user-writable paths is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces malware loaders running under a signed binary.

Renamed Regsvr32 or Rundll32 Loading a DLL With a Non-Standard Extension (via process_creation)

This rule detects regsvr32 or rundll32 loading a module that carries a disguised or non-standard extension such as .dat, .tmp, .png or .log from a user-writable directory, a masquerading pattern used by loaders like Qbot to hide their DLL payload. Proxy execution of renamed DLLs is documented in the Red Canary Threat Detection Report as a way to defeat extension-based controls. Detecting these disguised module loads surfaces the payload execution.

Malicious Rundll32 DllRegisterServer Execution From a User-Writable Path (via process_creation)

This rule detects rundll32.exe invoking the generic DllRegisterServer export on a DLL located in a user-writable directory such as AppData, Temp or ProgramData, a proxy-execution pattern used to run attacker DLLs under a trusted binary and bypass application controls. Rundll32 abuse is a top System Binary Proxy Execution technique in the Red Canary Threat Detection Report. Detecting DllRegisterServer calls against non-system DLL paths surfaces the evasion.

IMEEX Framework DLL Execution via Rundll32 Loading imaadp (via process_creation)

This rule detects rundll32.exe loading the imaadp.dll module used by the IMEEX framework to run its 64-bit backdoor while masquerading under a trusted host process. Invocation of this specific module name through rundll32 indicates the implant executing on the host.

Suspicious Persistence via pcalua Launching rundll32 Control_RunDLL

This rule detects the Program Compatibility Assistant pcalua being abused to launch rundll32 with the Control_RunDLL export against a user profile DLL. RedCurl uses this scheduled task chain to persist its BrowserSpec loader while masking the parent process.

Suspicious Rundll32 Executing DLL Start Export With Control Flags

This rule detects rundll32.exe calling a DLL Start export together with WarmCookie control flags such as /p /u or /update. WarmCookie also known as BadSpace was launched through rundll32 invoking its Start export with these command switches. The Start export paired with these operational flags is a distinctive WarmCookie loader signature for proxied malicious DLL execution.

Suspicious Rundll32 Execution of Timestamp-Named DLL

This rule detects rundll32 executing a DLL whose file name is a 14-digit timestamp such as YYYYMMDDHHmmSS.dll. The Lampion malware chain drops and runs a payload DLL named after the current date and time to evade static signatures. This automatically generated naming pattern combined with rundll32 proxy execution indicates malicious loading.

Suspicious Rundll32 Loading DLL from LocalAppData with Short Export (via process_creation)

This rule detects rundll32.exe invoking a DLL staged in the user LocalAppData directory with a single character export ordinal, the loader behavior of the KimJongRAT sys.dll module that Kimsuky drops into the user profile. Adversaries leverage rundll32 as a signed proxy to execute their DLL under a trusted process, making early detection critical for surfacing loader activity before browser and credential theft.

Malicious Word Spawning Rundll32 Loading DLL from Roaming Word Folder

This rule detects winword.exe launching rundll32.exe to load a DLL staged under the AppData Roaming Microsoft Word directory which is the Hancitor maldoc execution chain preceding Cuba ransomware. The malicious macro drops and side loads the loader from a user writable path. It is important because this parent child pattern reliably marks initial Hancitor infection.