Sigma detection rules, expert-reviewed

Malicious LSASS Memory Dump via Rundll32 comsvcs.dll MiniDump

This rule detects rundll32.exe invoking the comsvcs.dll MiniDump export to dump process memory, a LOLBIN LSASS dumping technique documented by Huntress. Attackers first resolve the LSASS process id via tasklist and then dump its memory to harvest plaintext credentials and hashes. Because comsvcs MiniDump has no legitimate administrative use, this is a high-confidence credential-theft signal.

Suspicious Wscript Spawning Rundll32 to Load Remote DLL (via process_creation)

This rule detects wscript.exe launching rundll32.exe, an unusual parent-child relationship used by the Strela Stealer JavaScript loader to execute a WebDAV-hosted DLL payload. Legitimate scripts rarely invoke rundll32 in this manner.

Renamed Qbot Loader Execution via rundll32 Running DAT File with xlAutoOpen Export (via process_creation)

This rule detects rundll32.exe invoking a .dat file through the xlAutoOpen export, the execution behavior a Qbot XLL phishing chain uses to run its decrypted loader before injecting into wermgr.exe. Adversaries reuse the Excel add-in entry point from a renamed DLL to launch the banking trojan under a trusted binary, making early detection critical for stopping the intrusion at the loader stage.

Malicious Keylogger DLL Execution via Rundll32 klg.dll

This rule detects rundll32.exe loading a DLL named klg.dll which Interlock ransomware operators deploy as a keylogger to capture credentials and keystrokes. The specific module name executed through rundll32 is a reliable behavioral indicator of the keylogging component.

Suspicious rundll32 shell32.dll Ordinal 61 Execution

This rule detects rundll32.exe calling shell32.dll by ordinal number 61, a proxy-execution trick observed in the NightshadeC2 loader chain. Invoking shell32 functions by ordinal avoids readable export names and is used to launch further stages while blending into normal rundll32 usage. Ordinal-based shell32 execution rarely appears in legitimate activity.

Suspicious Browser History Clearing via RunDll32 InetCpl ClearMyTracksByProcess (via process_creation)

This rule detects rundll32.exe invoking InetCpl.cpl ClearMyTracksByProcess to wipe browsing history and cached traces, an indicator-removal behavior used by the CylindricalCanine GoldenEyeDog subgroup during the DigiCert-linked intrusion. Adversaries clear these tracks to hinder investigation after credential and screenshot collection, making detection useful for surfacing anti-forensic activity on a compromised host.

Malicious WebDAV Payload Execution via rundll32 davclnt.dll (via process_creation)

This rule detects rundll32.exe invoking DavSetCookie from davclnt.dll, a WebDAV execution technique used by the TimbreStealer campaign to run remote payloads. Executing through the WebDAV client library retrieves and launches code from a remote share under a signed binary.

Malicious rundll32 Executing w32analytics DLL Export (via process_creation)

This rule detects rundll32 loading w32analytics.dll and invoking its dll_u export, the execution stage of the loader observed in recent unusual malware. Proxying execution through rundll32 with a named DLL export runs attacker code under a trusted signed Windows utility.

WebDAV Remote Payload Retrieval via Rundll32 DavSetCookie

This rule detects rundll32.exe calling davclnt.dll with the DavSetCookie export followed by a remote host, a WebDAV based download and execution technique used by the Andromeda Gamarue cluster. This pattern pulls a remote payload over WebDAV while hiding behind a signed Windows binary.

Suspicious Scheduled Task Running rundll32 DllRegisterServer Every Minute

This rule detects creation of a scheduled task that repeatedly invokes rundll32 against the DllRegisterServer export on a per-minute trigger. OysterLoader uses this technique to persist a malicious DLL dropped into the user profile. A minute interval task launching rundll32 with DllRegisterServer is rarely legitimate and typically indicates loader persistence.

Windows Rundll32 Execution of Ammy Admin Agent DLL

Identifies rundll32 executions that invoke the Ammy Admin agent DLL with a run parameter on Windows.

Windows Security Event 4698: Kapeka-like Scheduled Task Creation

Flags suspicious Kapeka-like scheduled task creation via Event 4698 using TaskContent paths, rundll32/.wll command markers, and OneDrive/Sens Api task names.

Windows Registry Run Key Autorun Entries Targeting Kapeka Backdoor

Flags Windows Run key registry changes whose data matches a Kapeka-style rundll32 .wll (#1) autorun entry.

Kapeka backdoor execution via rundll32.exe with export ordinal #1 and -d on Windows

Flags rundll32.exe command lines launching a Kapeka payload from ProgramData/AppData Local using export ordinal #1 with "-d".

Windows Kapeka Backdoor Persistence via schtasks ONSTART or Run Registry Autorun

Flags Windows persistence creation for Kapeka using schtasks (ONSTART) or Run registry entries plus rundll32 ordinal-based execution.