Every published rule

Windows Rundll32 Calls DavSetCookie for NTLM Coercion via Spoolss/Srvsvc

Detects rundll32.exe launching davclnt.dll DavSetCookie with HTTP and spoolss/srvsvc pipe parameters associated with NTLM coercion.

Windows rundll32.exe executing InstallScreenSaver via desk.cpl SCR File

Detects rundll32.exe launches with InstallScreenSaver behavior via desk.cpl, a screensaver execution technique.

Windows: rundll32.exe spawning explorer.exe child process (shell32.Control_RunDLL)

Alerts on rundll32.exe spawning explorer.exe, an uncommon child process pattern that may indicate stealthy execution via shell components.

Suspicious Child Process Spawning by PowerShell on Windows

Alerts when PowerShell spawns potentially suspicious child binaries (e.g., certutil, mshta, wmic, rundll32), with exclusions for known benign patterns.

Windows Rundll32 Key Manager Launch (keymgr KRShowKeyMgr) Credential Access

Alerts on rundll32 launching the Windows Key Manager (keymgr / KRShowKeyMgr), a potential credential access step.

Windows: Rundll32 Executing Registered COM Local Servers via Command-Line { }

Flags rundll32.exe launching COM local servers using -sta/-localserver with braced arguments.

Windows LOLBIN Execution From Abnormal Drive (calc, certutil, mshta, regsvr32, rundll32)

Flags Windows LOLBIN execution when process CurrentDirectory is not empty/null and contains C:\, indicating unusual launch context.

Windows rundll32 Execution With Uncommon DLL/CPL/INF Extension in Command Line

Alerts on Windows rundll32 executions whose command lines lack common .cpl/.dll/.inf endings, indicating potential unusual invocation.

Windows Backup File Deletion Triggered by CLI or Script Hosts

Alerts when cmd.exe, PowerShell, wt.exe, rundll32.exe, or regsvr32.exe delete files with backup-oriented filename extensions.

Windows: Rundll32 Loading shell32.dll via Control_RunDLL from User/Temp Paths

Alerts on rundll32.exe loading shell32.dll with Control_RunDLL from AppData/Temp/user paths.

Windows vmtoolsd.exe Child Process Spawn via Scripting/Utility Binaries

Alert on vmtoolsd.exe spawning cmd/powershell/mshta/regsvr32/rundll32/wscript child processes with VM Tools batch-script command lines.

Windows spoolsv.exe Child Process Execution Indicators

Flags suspicious process executions where spoolsv.exe (print spooler) spawns utility, scripting, or rundll32 children with high integrity.

Windows Rundll32 Loads DLL Export StartNodeRelay (F-Secure C3)

Flags rundll32.exe launching a DLL that references the StartNodeRelay export in its command line.

Windows Rundll32 Used to Start Cobalt Strike DLL Load via StartW

Alerts on rundll32.exe command lines that include a .dll and StartW function, consistent with Cobalt Strike DLL loading.

Windows rundll32.exe Started Without Command-Line Parameters

Alerts on Windows process launches of rundll32.exe with no parameters, excluding likely benign parent paths.

Windows Process Creation: rundll32.exe Command Line Invoking .sys Files

Flags Windows rundll32.exe executions whose command line references .sys file patterns.

Windows rundll32 Executing Inline VBScript via RegRead

Detects rundll32.exe command lines containing inline VBScript execution with RegRead and window.close.

Windows Process Creation: Detect ShimCache Flush via rundll32 apphelp.dll/kernel32.dll

Flags rundll32 command-line activity that flushes ShimCache via apphelp.dll or kernel32.dll entry points.

Windows rundll32.exe execution with no parameters or arguments

Alerts on Windows rundll32.exe being started with an empty/no-parameter command line.

Windows Process Creation: 7z Archive Creation with Script/Command Launch Chaining

Flags Windows process creation chaining 7z archive commands with .zip plus .txt/.log extensions and wscript+rundll32 context.