Sigma detection rules, expert-reviewed

Suspicious Rundll32 Loading DLL from User-Writable Path (via process_creation)

This rule detects rundll32.exe loading a DLL from a user-writable directory such as ProgramData or AppData. AresLoader downloads its DLL into %AllUsersProfile% and invokes it through rundll32 with an exported ordinal to run the loader. Rundll32 executing a DLL from a staging directory is a frequent proxy-execution and defense-evasion pattern.

Suspicious Rundll32 Execution of WebDAV-Hosted DLL via Entry Export (via process_creation)

This rule detects rundll32.exe loading a DLL from a WebDAV UNC path and calling the exported function named Entry. Strela Stealer uses this technique to execute a fileless DLL payload delivered over WebDAV.

Malicious Tpwinprn DLL Loaded via Renamed rundll32 by Diplomatic Specter

This rule detects execution referencing the Tpwinprn.dll payload run through a renamed copy of rundll32 from SysWOW64, a loader behavior tied to the Operation Diplomatic Specter Chinese cyberespionage campaign. Renaming a signed system binary to proxy DLL execution helps the actor evade image-name detections. Detecting this reveals masqueraded loader activity delivering the espionage toolkit.

Suspicious Masqueraded Rundll32 with Mismatched Original Filename (via process_creation)

This rule detects a process whose embedded original filename is RUNDLL32.EXE but whose on-disk name is something else. Nokoyawa intrusions run IcedID by copying rundll32 to a decoy name such as Calc.exe to blend into normal activity. A binary lying about its identity through a renamed copy is a reliable masquerading indicator.

Malicious rundll32 Loading dat Payload via afunix Export

This rule detects rundll32.exe loading a file with a .dat extension and invoking the afunix export with a key argument. This loader pattern is used by the Lazarus group during Operation SyncHole watering-hole attacks to execute the ThreatNeedle and related malware via a trusted signed binary. The non-DLL extension plus specific export name distinguishes it from normal rundll32 usage.

Suspicious Deadglyph Rundll32 DLL Execution by Ordinal via process_creation

This rule detects rundll32.exe executing the pbrtl.dll loader by ordinal

Malicious WARMCOOKIE DLL Execution from RtlUpd Path via rundll32

This rule detects rundll32.exe executing a DLL from the C:\ProgramData\RtlUpd directory, the fixed drop path and loader behavior of the WARMCOOKIE backdoor. The malware writes RtlUpd.dll to this ProgramData location and runs it via rundll32 to establish its foothold.

Malicious LockBit Rundll32 Execution With gdll Export and -pass Argument

This rule detects rundll32.exe invoking a DLL export named gdll together with a -pass argument, the loader pattern used by LockBit 3.0 payloads staged from a batch file on the user Desktop. Huntress observed operators abusing a TeamViewer session to drop and run this payload for ransomware deployment. Catching the export and password-flag combination flags encryptor execution before file encryption completes.

Malicious EDR Termination via rundll32 Loading polers.dll Targeting Fortinet Processes (via process_creation)

This rule detects the Interlock EDR killer which uses rundll32.exe to invoke the exported start routine of polers.dll and terminate security processes matching the Forti pattern through a vulnerable anti cheat driver. The watchdog repeatedly relaunches to keep defenses down. This command line is unique to the tooling.

Suspicious Proxy Execution of rundll32 Control_RunDLL via pcalua.exe (via process_creation)

This rule detects the Program Compatibility Assistant launcher pcalua.exe being used to run rundll32 with shell32.dll Control_RunDLL, a living off the land chain that the RedCurl EarthKapre APT uses to proxy execution of its payload. The pcalua binary masks the parent-child lineage of the launched code. This nested launcher and control panel invocation is not a normal user or administrator workflow.

Suspicious Browser History Wipe via RunDll32 ClearMyTracksByProcess

This rule detects rundll32 invoking InetCpl ClearMyTracksByProcess to clear browsing and cache artifacts. The Gh0stGambit dropper used this to erase indicators after deploying Gh0st RAT. Programmatic history wiping through this control panel handler is a cleanup step rarely performed by normal user activity.

Malicious LATRODECTUS Loader DLL Execution via rundll32 via process_creation

This rule detects rundll32.exe executing a DLL from the LATRODECTUS Custom_update staging directory using its Update-prefixed filename. The loader drops its payload as an Update DLL and invokes it through rundll32 to initialize the ICEDID-successor implant. This execution pattern is characteristic of LATRODECTUS post-installation activity.

In-Memory Rundll32 Execution Without a Command Line (via process_creation)

This rule detects rundll32.exe running with no export or arguments on its command line, an anomalous state that legitimate use rarely produces and that commonly indicates code injection into a hollowed rundll32 process. Both System Binary Proxy Execution and Process Injection rank among the top techniques in the Red Canary Threat Detection Report, and an argument-less rundll32 is a strong heuristic for the latter. Detecting this pattern surfaces stealthy in-memory execution under a trusted binary.

Suspicious rundll32 Loading DEEPDATA data.dll with mod.dat Key via BrazenBamboo

This rule detects rundll32 loading data.dll together with a mod.dat argument the loading pattern of the BrazenBamboo DEEPDATA malware framework. DEEPDATA decrypts its payload using the mod.dat key file. Proxy execution via rundll32 helps evade application controls and disguise malware as a signed process.

Suspicious rundll32 Loading DLL from AppData via DllRegisterServer

This rule detects rundll32 executing a DLL located under AppData through the DllRegisterServer entry point. OysterLoader stages its COPYING3.dll payload in the roaming profile and runs it with this export. Running an AppData resident DLL through rundll32 with DllRegisterServer is a recognised loader execution pattern.