Sigma detection rules, expert-reviewed

Malicious Hunters International Ransomware Execution via rundll32

This rule detects rundll32.exe executing the Hunters International ransomware encryptor DLL through its Open export with the operator flags used to target running processes. This proxy execution technique masks the ransomware payload behind a signed Windows binary immediately before mass file encryption, making it a critical late-stage indicator.

Suspicious Curl Download of DAT Payload Followed by Rundll32 Execution

This rule detects curl.exe retrieving a file with a DAT extension, the payload staging step used by Pikabot before renaming it to a DLL and loading it with rundll32. Attackers use a benign looking data extension to slip the loader past extension based controls.

Malicious Rundll32 Loading Update DLL from AppData Custom_update with scab Export

This rule detects rundll32.exe loading an Update DLL from a user AppData Custom_update directory and calling the scab export, the loader execution used by DanaBot to run IcedID. This proxy execution runs the malicious module under a trusted signed binary to evade application controls.

Malicious Rundll32 Executing Svchost-Masquerading DLL via Command Line

This rule detects rundll32 executing a DLL named to typosquat svchost with a Start export, an execution technique following WS_FTP CVE-2023-40044 exploitation. The doubled-t filename svchostt.dll disguises malicious code as a system component. Detecting it exposes DLL-based payload execution on the host.

Malicious BRUSHLOGGER Rundll32 Execution from ProgramData (via process_creation)

This rule detects rundll32 loading the BRUSHLOGGER Recorder.dll from the attacker's ProgramData staging directory. Observed in Elastic Security Labs analysis where Recorder.dll under a Photoes Pics path is executed to capture keystrokes from financial services targets.

Malicious WARMCOOKIE Loader Execution via rundll32 RtlUpd via process_creation

This rule detects rundll32.exe executing the WARMCOOKIE backdoor DLL RtlUpd.dll with its Start export. The backdoor is dropped to the ProgramData RtlUpd directory and invoked through rundll32 for execution and persistence. This specific module and export combination is a high-confidence WARMCOOKIE indicator.

Malicious DcRAT Loader Execution via rundll32 from Microsoft-Activation-Scripts Directory (via process_creation)

This rule detects rundll32 loading a DLL from a Microsoft-Activation-Scripts directory, the staging path used by Sandworm to execute the DcRAT loader disguised as KMS activation tooling. Exporting a function from a DLL placed in this masquerading folder is not legitimate Windows behavior. This indicates hands-on-keyboard payload execution.

Malicious Latrodectus DLL Execution via rundll32 from AppData Roaming (via process_creation)

This rule detects rundll32 executing the vierm_soft_x64 DLL from AppData Roaming, the Latrodectus payload LUNAR SPIDER disguised as a legitimate NVIDIA file. The malicious DLL is dropped by an MSI installer and launched from a user profile directory. This combination indicates loader execution ahead of Brute Ratel deployment.

Malicious DLL Execution With Non Standard Extension via rundll32

This rule detects rundll32.exe loading a library renamed with a .db extension which the DPRK aligned Stressed Pungsan npm campaign uses to masquerade its downloaded payload package.db and execute an exported function while evading extension based detection.

Andromeda Loader Execution via Rundll32 Desktop.ini Ordinal

This rule detects rundll32.exe invoking a DLL export _ldr together with a desktop.ini argument, the loader launch pattern of the Andromeda Gamarue cluster. Using rundll32 to call an obscure loader ordinal while referencing desktop.ini is a distinctive execution and evasion behavior.

Suspicious rundll32 Execution of sqlite3 DLL by Ordinal with TLB Argument

This rule detects rundll32 loading a sqlite3 DLL by ordinal export #138 together with an x64.tlb argument, the loader invocation used by the Winnti arsenal in Operation CuckooBees. Attackers disguise the malicious payload as a legitimate sqlite3 library and pass a type-library file to trigger execution. This precise ordinal-and-tlb combination is a high-confidence Winnti loader indicator.

Malicious Zardoor Backdoor Execution via rundll32 (via process_creation)

This rule detects rundll32.exe invoking the MainEntry export of zar32.dll or zor32.dll, the core execution modules of the Zardoor backdoor. These components provide command-and-control and reverse-proxy capability during long-term espionage operations.

Suspicious Browser History Wipe via Rundll32 ClearMyTracksByProcess (via process_creation)

This rule detects rundll32.exe invoking InetCpl.cpl ClearMyTracksByProcess to clear browser history and cache as used by the HiddenGh0st malware to remove traces. This indicator flag combination erases stored browsing artifacts on the host.

Malicious Office Application Loading a User-Path DLL via Regsvr32 or Rundll32 (via process_creation)

This rule detects a Microsoft Office application spawning regsvr32 or rundll32 to load a DLL from a user-writable path such as AppData, Temp or ProgramData, the macro-driven loader pattern used by families like Emotet to execute their payload after a malicious document is opened. This document-to-DLL execution chain is documented in the Red Canary Threat Detection Report. Detecting the Office-to-DLL proxy execution surfaces the intrusion at the initial-access boundary.

Malicious Rundll32 Loading an Export From a User Path (via process_creation)

This rule detects rundll32.exe executing a named or ordinal export from a DLL located in AppData, ProgramData or Temp, the execution behavior IcedID and Bumblebee use to run a downloaded loader. Rundll32 export execution from user-writable paths is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces malware loaders running under a signed binary.