Every published rule

Windows PowerShell Command Lines with WMI Process Creation and rundll32 Invocation

Flags Windows command lines where PowerShell/WMI is used to spawn rundll32 from c:\windows.

Windows rundll32.exe Command-Line RunDLL or Control_RunDLL Execution

Alerts on rundll32.exe process launches whose command lines end with RunDLL/Control_RunDLL, indicative of DLL function loading.

Windows Process Tree: rundll32.exe launching wermgr.exe via DllRegisterServer

Flags rundll32.exe spawning wermgr.exe where rundll32 command line includes DllRegisterServer.

Windows Process Creation: Default-Argument Invocation of Rundll32/WerFault/Regsvcs/Regasm/Regsvr32

Alerts on suspicious Windows process launches of key binaries with missing/empty arguments, excluding common Edge/Chromium installer use.

Windows: rundll32 Triggering comsvcs.dll MiniDump Against lsass.exe

Detects rundll32 invoking comsvcs.dll to dump lsass.exe via a MiniDump export.

PowerShell ScriptBlock Logging: Obfuscated RUNDLL Launcher using rundll32.exe and shell32.dll

Identifies PowerShell script content invoking rundll32.exe/shell32.dll via shellexec_rundll and referencing PowerShell.

PowerShell module activity launching rundll32 via shell32.dll obfuscation content

Alerts when PowerShell module payloads reference a shell32/rundll32 launcher pattern that includes PowerShell.

Windows System: Detect rundll32 Service Control Manager launches PowerShell via obfuscated parameters

Flags service creation where ImagePath uses rundll32/shell32 (shellexec_rundll) to invoke PowerShell.

Windows Security 4697: Obfuscated PowerShell via rundll32 shell32 shellexec_rundll

Alert on Security EID 4697 where service installation references rundll32/shell32.dll to launch PowerShell.

Windows Service Control Manager Rundll32 Obfuscation via Command-Line Encoded PowerShell

Detects service creation where ImagePath invokes rundll32 (shell32) with command-chain tokens indicative of obfuscated PowerShell.

Windows Security 4697: Obfuscated command uses rundll32 with shell32.dll

Alerts on EventID 4697 service command lines containing rundll32 with shell32.dll/shellexec_rundll and obfuscation-like script fragments.

Rundll32 Executes Setupapi.dll InstallHinfSection via Runonce.exe

Alerts when rundll32 passes setupapi.dll::InstallHinfSection arguments that result in launching runonce.exe.

Windows: Rundll32 LaunchApplication via pcwutl.dll

Flags rundll32.exe using pcwutl.dll to invoke LaunchApplication.

Windows TAIDOOR RAT DLL Load via rundll32 Command Line

Detects Windows process creation command lines consistent with TAIDOOR RAT DLL loading through rundll32.exe.

Windows process execution matching Winnti RedMimicry playbook (rundll32/cmd with temp batch and gthread/sigcmm DLLs)

Flags rundll32.exe/cmd.exe launches with Winnti-specific DLL and temp batch indicators.

Windows rundll32 WebDAV Client Execution (davclnt.dll DavSetCookie)

Flags svchost.exe spawning rundll32.exe to run davclnt.dll,DavSetCookie, consistent with WebDAV client execution.

Windows Process Memory Dump via comsvcs.dll using rundll32

Alert on rundll32 loading comsvcs.dll with arguments consistent with a full process memory dump.

Windows: Child Process Spawned with SYSTEM Integrity by LOCAL/NETWORK SERVICE Parent

Alert on Windows executions where a SYSTEM-integrity child is spawned by a LOCAL SERVICE or NETWORK SERVICE parent, excluding a specific rundll32 pattern.

Rundll32.exe DLL Export Calls by Ordinal (Windows Process Creation)

Detects rundll32.exe commands that specify DLL exports by ordinal using “.dll #” syntax.

PowerShell ScriptBlock uses rundll32 with shell32.dll and obfuscated invoke/comspec/iex

Flags PowerShell script blocks containing rundll32/shell32.dll execution strings alongside invoke/iex/comspec patterns.