Sigma detection rules, expert-reviewed

Suspicious Rundll32 Execution Without Arguments

This rule detects rundll32.exe launched with no DLL or export arguments, a hollowing or injection precursor observed in the Gootloader chain. A bare rundll32 process is typically spawned to host injected code rather than to run a legitimate library export. This anomaly is a reliable indicator of process injection staging.

Malicious rundll32 Execution of BoomBox NativeCache DLL (via process_creation)

This rule detects rundll32.exe loading a DLL from the AppData Microsoft NativeCache path with the _configNativeCache export, the BoomBox downloader execution chain. BoomBox uses this proxied DLL execution to run in memory under a trusted binary and stage follow-on payloads used by Nobelium.

Malicious rundll32 vbscript mshtml RunHTMLApplication Execution

This rule detects rundll32.exe invoking the vbscript protocol handler with mshtml RunHTMLApplication to execute inline script, a living-off-the-land technique used by the Sibot malware to run RegRead logic and retrieve its second stage. This LOLBin invocation has no legitimate use and bypasses application controls. Its presence indicates in-memory script execution and defense evasion.

Suspicious rundll32 Execution Without Command Line Arguments (via process_creation)

This rule detects rundll32 being launched without any DLL or export arguments on its command line. Black Basta loaders spawn rundll32 with no arguments as a host process for injected code, so an argument-less rundll32 invocation is an anomaly worth investigating for defense evasion.

Malicious rundll32 WebDAV UNC Execution over HTTP

This rule detects rundll32 loading a DLL from a remote WebDAV UNC path that references an attacker IP over HTTP which DarkGate uses to pull and execute its payload from the internet. Executing code from a remote WebDAV share via rundll32 is a strong indicator of DarkGate style remote payload delivery.

Suspicious rundll32 Execution of DLL from WebDAV Share (via process_creation)

This rule detects the Hive0145 Strela Stealer chain using rundll32.exe to run a crypted DLL directly from a WebDAV davwwwroot share and call its Entry export. Loading a DLL over WebDAV through rundll32 is a strong remote-execution indicator. Legitimate software does not launch DLLs from davwwwroot paths.

Malicious LSASS Memory Dump via Rundll32 and Comsvcs MiniDump

This rule detects rundll32.exe invoking comsvcs.dll MiniDump to dump process memory, the classic LSASS credential-theft technique that remained in use across the 2025 intrusions Huntress reviewed. Dumping LSASS extracts cached credentials and Kerberos material for lateral movement. The combination of comsvcs.dll and the MiniDump export from rundll32 has virtually no legitimate use on endpoints.

Suspicious DLL Execution via rundll32 from PerfLogs Directory

This rule detects rundll32 loading a DLL from the C:\PerfLogs directory, observed in the Netscaler intrusion where the actor ran ch.dll,Start from PerfLogs. PerfLogs is not a normal location for executable DLLs, so rundll32 invocation against it strongly indicates proxied malicious code execution.

Malicious DarkMe COM Object Execution via rundll32 CLSID

This rule detects rundll32.exe instantiating the DarkMe malware COM object by its hardcoded CLSID EA6FC2FF-7AE6-4534-9495-F688FEC7858C. This chain is used by actors exploiting the WinRAR CVE-2023-38831 zero-day to load GuLoader and Remcos. Executing malicious code through a COM CLSID abuses a trusted binary to evade detection.

Suspicious rundll32 Control_RunDLL DLL Execution

This rule detects rundll32 invoking a DLL through the Control_RunDLL entry point, a technique observed in a WizardSpider-themed intrusion chain to proxy execution of a malicious DLL named adb.dll. It captures signed-binary proxy execution used to blend malicious code with legitimate control-panel handling. Detecting this is important because Control_RunDLL is frequently abused to run attacker DLLs while evading application controls.

Malicious Browser Credential Theft via rundll32 Loading move.dll (via process_creation)

This rule detects the Interlock custom infostealer move.dll executed through rundll32.exe with a start argument, a DER key file and a target host to collect browser credential stores. The stolen data is written per host as a CSV file. This rundll32 invocation of move.dll with a key file is characteristic of the stealer.

Malicious FrostyNeighbor ViberPC Renamed Rundll32 DLL Execution

This rule detects a rundll32 copy renamed to ViberPC.exe loading ViberPC.dll and invoking its SettingTimeAPI export, the execution chain used by the FrostyNeighbor PicassoLoader campaign. Renaming rundll32 and the payload to imitate the Viber messenger disguises DLL proxy execution as a trusted application.

Malicious Rundll32 notepad2 DLL Proxy Execution

This rule detects rundll32 loading notepad2.dll and invoking its notepad export, the proxy-execution technique used by the spyware in the Pakistan dating-app campaign. Naming the malicious DLL and export after Notepad disguises code execution as a benign editor, so this specific invocation reveals the loader.

Suspicious rundll32 Execution of PNG File as DLL

This rule detects rundll32.exe being pointed at a file with a .png extension and a start export, which loads the image as a DLL. Interlock masqueraded its DLL payloads with .png and other benign extensions to bypass file-type inspection and defender expectations. Executing a renamed DLL through rundll32 is a defense-evasion technique used to stage the next loader stage.

Malicious Interlock LNK Execution via rundll32 ShellExec_RunDLL

This rule detects rundll32.exe invoking the shell32.dll ShellExec_RunDLL function to launch a masqueraded LNK file. The Interlock KongTuke ClickFix chain used this technique to execute a dropped shortcut as part of its multi-stage loader. Proxying execution through a signed binary lets attackers run their payload while evading application controls that trust rundll32.