Sigma detection rules, expert-reviewed

Malicious Rundll32 Execution Of HTML Payload With DllRegisterServer

This rule detects rundll32 loading a file with an .html extension and calling the DllRegisterServer export, the disguised DLL execution used in the Zloader attack against Intel 471. Masquerading the DLL as an HTML file evades extension-based inspection while rundll32 still runs it as a library. This mismatch of extension and export is a strong loader indicator.

Malicious SnipBot DLL Execution via rundll32 from KeyStore Directory (via process_creation)

This rule detects rundll32 loading SnippingTool.dll from a KeyStore folder and invoking its Main export, the execution technique used by the SnipBot variant of RomCom malware. Proxying execution of the malicious DLL through the trusted rundll32 binary helps the loader evade application controls.

Malicious Lazarus Rundll32 Execution of Sup ETL Privilege Escalation Loader (via process_creation)

This rule detects rundll32.exe executing a sup.etl file from the USOShared directory using the SerializeMarketTable export as observed in the Lazarus attack on Windows web servers. Loading an etl file as a DLL through an unusual export is a strong indicator of this loader.

Suspicious WARMCOOKIE Scheduled Task for rundll32 Persistence via process_creation

This rule detects creation of a scheduled task that runs rundll32 against the WARMCOOKIE loader RtlUpd at a short recurring interval to maintain persistence. The backdoor registers a task firing every ten minutes to ensure continuous execution. The combination of a minute-based recurrence with rundll32 loading this DLL is characteristic of WARMCOOKIE.

Suspicious DanaBot Updater Scheduled Task Running Rundll32 from AppData via schtasks

This rule detects creation of a scheduled task named Updater that launches rundll32.exe against a DLL staged under a per-user AppData Custom_update directory, a persistence pattern used by DanaBot when deploying IcedID. Attackers abuse task scheduler plus rundll32 proxy execution to survive reboots and blend malicious loader activity into routine update tasks.

Malicious NotPetya Payload Execution via Rundll32 Ordinal Export from Windows Directory

This rule detects rundll32 launching a DLL from the Windows root directory by ordinal export number one which matches the NotPetya execution pattern documented by NCC Group. The ransomware was copied into the Windows folder and executed via its first ordinal to encrypt disks and spread laterally.

Suspicious COLDRIVER BAITSWITCH Execution via Rundll32 Verifyme Export (via process_creation)

This rule detects rundll32 invoking a DLL export named verifyme as used by the COLDRIVER ClickFix chain to run the BAITSWITCH loader from a remote share. Rundll32 calling this export is characteristic of the campaign.

SwimSnake AutoRecoverDat.dll Execution via rundll32 or regsvr32 (via process_creation)

This rule detects rundll32.exe or regsvr32.exe executing AutoRecoverDat.dll, the module the SwimSnake (Silver Fox) group drops into the user AppData Embarcadero folder to load shellcode and deploy the WinOS backdoor. Adversaries proxy execution of the malicious DLL through trusted signed binaries to evade application controls, making early detection critical for catching the loader before backdoor communication.

Suspicious Rundll32 Loading DLL From User Desktop

This rule detects rundll32.exe loading a DLL located under a user Desktop directory, a staging pattern seen when LockBit 3.0 payloads were dropped alongside a launcher batch file during hands-on-keyboard intrusions. Legitimate software rarely places and runs DLLs directly from the Desktop. Flagging this location reveals attacker-controlled payloads executed via a trusted signed binary.

Malicious rundll32 Loading DLL from WebDAV SSL Share

This rule detects rundll32 loading a DLL from a WebDAV SSL share indicated by the @SSL path token, an intrusion step observed in ACR Stealer delivery chains. Executing a remotely hosted DLL over WebDAV lets the attacker run code without writing the payload to local disk and evades application controls.

Suspicious TimbreStealer Execution via rundll32 iernonce.dll (via process_creation)

This rule detects rundll32.exe loading iernonce.dll, the module executed via a run-once mechanism by the TimbreStealer information stealer targeting Mexican users. The stealer proxies its execution through rundll32 to evade defenses while collecting browser credentials.

Malicious Pikabot Rundll32 Loading DLL with Enter Export

This rule detects rundll32.exe loading a DLL and calling the Enter export, the loader execution used by Pikabot after a downloaded DAT payload is renamed to a DLL. Running the module through rundll32 proxy execution hides the malicious code under a trusted signed binary.

Suspicious DLL Sideloading via rundll32 Loading MSADOCG (via process_creation)

This rule detects rundll32.exe loading MSADOCG.DLL, the sideloaded module used to launch the SugarGh0st RAT payload. Sideloading a maliciously named DLL through rundll32 hides code execution behind a signed Windows utility.

Suspicious Rundll32 Execution Of DllGetClassObject Export via Process Creation

This rule detects rundll32.exe invoking the DllGetClassObjectGuid export. Cuba ransomware executes its loader DLL through rundll32 using this specific non-standard export name to proxy execution, an artifact with no known legitimate use.

Malicious rundll32 Execution of COLDCOPY DLL via COLDRIVER ClickFix

This rule detects rundll32.exe invoking COLDCOPY DLLs by their known filenames or by the humanCheck and verifyme export names used in COLDRIVER ClickFix lures. Attackers run these exports to launch the YESROBOT and MAYBEROBOT backdoors after tricking a user into pasting a Run dialog command.