Sigma detection rules, expert-reviewed

Malicious Mispadu Payload Execution from WebDAV Share via Rundll32 (via process_creation)

This rule detects rundll32.exe executing a DLL from a remote WebDAV share referenced through a file URL, a delivery technique used by the Mispadu infostealer to bypass SmartScreen and run its payload. Mispadu is a Latin American banking trojan that harvests browser credentials, and this remote execution path lets it evade reputation-based controls during initial access.

Malicious Scheduled rundll32 Execution of ProgramData VMware DLL by BianLian

This rule detects rundll32.exe executing a DLL from a ProgramData VMware directory with an Entry export and redirecting output to a temp file, matching the persistence and execution behavior of the BianLian ransomware group per Unit 42. The actor masquerades its loader as a VMware component and runs it via a scheduled task which evades scrutiny and maintains access.

Malicious rundll32 Execution of Lazarus JavaPackage DLL (via process_creation)

This rule detects rundll32.exe executing a DLL from the ProgramData Oracle Java path via the VpnUserInterface export, the loader used in a Lazarus social engineering initial access chain. The masqueraded Java path combined with the VpnUserInterface export is a specific implant artifact. This proxies malicious code through a signed binary to establish a foothold for follow-on tasking.

Malicious Cobalt Strike Loader via rundll32 From ProgramData (via process_creation)

This rule detects rundll32.exe executing a DLL from the ProgramData directory using the DllRegisterServer export, the Cobalt Strike loading pattern seen in a LockBit 3.0 intrusion. Legitimate DLLs are rarely staged in ProgramData and run this way. Proxying a beacon through a signed binary from a writable path enables stealthy command-and-control ahead of ransomware deployment.

Malicious rundll32 IternalJob Export Spawned by wscript (via process_creation)

This rule detects wscript.exe spawning rundll32.exe to call the IternalJob export, the execution chain used by the BumbleBee loader launched from a VBS script via a scheduled task. The misspelled IternalJob export name is a specific loader artifact. This chain proxies malicious code execution through a signed binary to load BumbleBee and stage follow-on payloads.

Suspicious Rundll32 Copied to Startup Folder via Blister Loader

This rule detects a copy of rundll32.exe being written into the user Startup folder, a persistence technique used by the Blister loader which drops rundll32.exe alongside its own payload DLL to auto-run at logon. Placing a legitimate system binary outside System32 in a Startup path is a strong sign of DLL proxy execution being staged for persistence.

Suspicious Rundll32 Persistence via Registry Run Key (via registry_set)

This rule detects a Run key value being set to launch rundll32 at logon. The malvertising backdoor established persistence by writing a Run key that invokes rundll32 against a dropped DLL. Autorun entries that proxy execution through rundll32 are a well-known persistence and defense-evasion combination.

Suspicious Scheduled Task Launching rundll32 DLL via Ransomware

This rule detects schtasks creating a task that periodically executes rundll32 against a DLL as observed in ransomware persistence and re execution routines. Attackers schedule loader DLLs to survive reboots and re trigger their payload on a recurring interval.

Suspicious Rundll32 Loading Non-DLL Image Extension File

This rule detects rundll32.exe executing an export from a file carrying an image or media extension rather than a DLL, a defense-evasion pattern used by APT41 PLUSDROP to conceal its loader payload. Running exported code from a masqueraded file lets the actor stage process injection into svchost.exe.

Malicious Rundll32 Execution of Image File Export via PLUSDROP

This rule detects rundll32.exe invoking an export from a file with an image extension staged in an image subfolder, matching the APT41 PLUSDROP loader launched from a malicious LNK to run the TOUGHPROGRESS chain. Attackers disguise the payload as a JPG to bypass extension-based inspection while executing an exported function.

Malicious DAEMON Tools Backdoor Execution via rundll32 mcrypto (via process_creation)

This rule detects rundll32.exe executing an export of the mcrypto module used by the DAEMON Tools supply chain backdoor to run and clean up its payload. The distinctive misspelled chiper export marks the malicious loader invocation. Detecting this command surfaces proxied backdoor execution on the host.

Suspicious rundll32 Execution of IconCache Masquerading DLL

This rule detects rundll32.exe executing a DLL located in the Explorer icon cache directory with an iconcache prefixed name. In Operation ForumTroll rundll32 was used as a proxy to load the payload DLL dropped to this path as reported by Kaspersky. Proxied execution of a masquerading DLL from a user profile cache directory is a strong signed binary proxy and defense evasion indicator.

Malicious LSASS Credential Dump via rundll32 and comsvcs MiniDump

This rule detects rundll32 invoking the comsvcs.dll MiniDump export to dump the memory of LSASS, a credential theft technique observed in the 2025 NTLM abuse campaigns. Attackers call comsvcs.dll MiniDump against the LSASS process id to write its memory to disk and later extract secrets. This is a well-established living-off-the-land method for harvesting cached credentials and NTLM hashes.

Suspicious RC4 DLL Sideloading via rundll32 by Tropic Trooper

This rule detects rundll32 loading datast.dll or datastate.dll, the RC4-encrypted loader components Tropic Trooper sideloads to run its Crowdoor backdoor against Middle East government entities. These specific DLL names invoked through rundll32 reflect the group's staged loader execution.

Suspicious rundll32 or mshta Proxy Execution of VBScript

This rule detects rundll32.exe or mshta.exe invoked with a vbscript protocol handler to proxy execution of Visual Basic script, the living-off-the-land method used to run VBScript that is stored in the registry or delivered inline. This technique bypasses application control by abusing a signed system binary as the script host. Such invocations have no legitimate administrative purpose.