Every published rule

Windows Qakbot-associated Rundll32 execution via suspicious parent process and export strings

Flags rundll32.exe executions tied to Qakbot-style export strings when launched by script/cmd utilities.

Windows rundll32.exe Execution via cmd/cscript/powershell with .dll and Suspicious Directories

Alerts on rundll32.exe execution with DLL arguments from common Windows script/LOLBins and suspicious staging paths.

Windows: Rundll32 Executions Using Obfuscated Ordinal Call Arguments

Flags rundll32.exe launches with command-line ordinal obfuscation patterns.

Windows: Suspicious rundll32 Execution of advpack.dll with Ordinal RegisterOCX Calls

Identifies rundll32.exe launching advpack.dll with ordinal-style calls consistent with stealthy OCX registration behavior.

Suspicious rundll32/regsvr32/msiexec Child Process from Windows Script Hosts (cscript/wscript)

Alerts on wscript/cscript spawning suspicious child processes or scripts that invoke rundll32/regsvr32/msiexec.

Windows Service Creation for Backdoor Persistence via GoogleUpdate (Event ID 7045)

Flags creation of a "GoogleUpdate" Windows service with rundll32/FileProtocolHandler image path pointing to ProgramData persistence.

Windows rundll32 Cleanup Export Execution via msupdate Service Host (ColdSteel)

Flags svchost.exe msupdate-style services spawning rundll32.exe to run cleanup-related exports.

Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie

Alerts on svchost.exe launching rundll32.exe to run davclnt.dll DavSetCookie for WebDav over a non-local IP.

Windows Rundll32 Execution Masquerading as Image Files via Image Extensions

Flags rundll32.exe executions whose command line references image file extensions used for DLL masquerading.

Windows: Rundll32 Launching NSIS Module for Stealer Capability

Alerts on rundll32.exe execution tied to NSIS module loading indicators (nsis_uns and PrintUIEntry) in the command line.

Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths

Detects rundll32 executions that reference DLLs stored in Alternate Data Streams via ADS-style paths.

Windows process creation: Suspicious child processes from WindowsApps directory

Alerts on suspicious cmd/PowerShell/mshta/rundll32-style child processes launched from Program Files\WindowsApps.

Windows Process Creation: Suspicious Child Process Spawned by Wermgr.EXE

Alerts on suspicious children spawned by wermgr.exe using common execution utilities, with a rundll32 WerConCpl exclusion.

Windows Remote Thread Creation via rundll32 Triggered by wab*, wabmig, or ImagingDevices

Alerts on remote thread creation targeting rundll32.exe from wab* or ImagingDevices.exe process images on Windows.

Windows Rundll32 Masquerading: DllRegisterServer CommandLine Not Using rundll32.exe

Alerts when 'DllRegisterServer' appears in the command line while the executing image is not rundll32.exe.

Windows rundll32 Loading Renamed comsvcs.dll via DLL Image Load

Flags rundll32.exe loading a renamed comsvcs.dll module consistent with process memory dumping behavior on Windows.

Windows rundll32 Locks Workstation via user32.dll LockWorkStation

Flags cmd-launched rundll32.exe calling user32.dll LockWorkStation to lock the user workstation.

Windows: rundll32.exe launched by explorer.exe parent process

Alerts when explorer.exe spawns rundll32.exe with specific command-line characteristics on Windows.

Windows: Raspberry Robin Command Execution via fodhelper.exe and rundll32/regsvr32

Flags Windows process-spawn chains where fodhelper.exe runs rundll32/regsvr32 with Raspberry Robin-style command-line patterns.

Windows: Registry Set by Rundll32 for Screen Saver Execution via SCRNSAVE.EXE

Flags Windows registry sets where Rundll32 points SCRNSAVE.EXE to a .scr file.