Sigma detection rules, expert-reviewed

Malicious Rundll32 Loading an Export From a User Path (via process_creation)

This rule detects rundll32.exe executing a named or ordinal export from a DLL located in AppData, ProgramData or Temp, the execution behavior IcedID and Bumblebee use to run a downloaded loader. Rundll32 export execution from user-writable paths is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces malware loaders running under a signed binary.

Renamed Regsvr32 or Rundll32 Loading a DLL With a Non-Standard Extension (via process_creation)

This rule detects regsvr32 or rundll32 loading a module that carries a disguised or non-standard extension such as .dat, .tmp, .png or .log from a user-writable directory, a masquerading pattern used by loaders like Qbot to hide their DLL payload. Proxy execution of renamed DLLs is documented in the Red Canary Threat Detection Report as a way to defeat extension-based controls. Detecting these disguised module loads surfaces the payload execution.

Malicious Rundll32 DllRegisterServer Execution From a User-Writable Path (via process_creation)

This rule detects rundll32.exe invoking the generic DllRegisterServer export on a DLL located in a user-writable directory such as AppData, Temp or ProgramData, a proxy-execution pattern used to run attacker DLLs under a trusted binary and bypass application controls. Rundll32 abuse is a top System Binary Proxy Execution technique in the Red Canary Threat Detection Report. Detecting DllRegisterServer calls against non-system DLL paths surfaces the evasion.

IMEEX Framework DLL Execution via Rundll32 Loading imaadp (via process_creation)

This rule detects rundll32.exe loading the imaadp.dll module used by the IMEEX framework to run its 64-bit backdoor while masquerading under a trusted host process. Invocation of this specific module name through rundll32 indicates the implant executing on the host.

Suspicious Persistence via pcalua Launching rundll32 Control_RunDLL

This rule detects the Program Compatibility Assistant pcalua being abused to launch rundll32 with the Control_RunDLL export against a user profile DLL. RedCurl uses this scheduled task chain to persist its BrowserSpec loader while masking the parent process.

Suspicious Rundll32 Executing DLL Start Export With Control Flags

This rule detects rundll32.exe calling a DLL Start export together with WarmCookie control flags such as /p /u or /update. WarmCookie also known as BadSpace was launched through rundll32 invoking its Start export with these command switches. The Start export paired with these operational flags is a distinctive WarmCookie loader signature for proxied malicious DLL execution.

Suspicious Rundll32 Execution of Timestamp-Named DLL

This rule detects rundll32 executing a DLL whose file name is a 14-digit timestamp such as YYYYMMDDHHmmSS.dll. The Lampion malware chain drops and runs a payload DLL named after the current date and time to evade static signatures. This automatically generated naming pattern combined with rundll32 proxy execution indicates malicious loading.

Suspicious Rundll32 Loading DLL from LocalAppData with Short Export (via process_creation)

This rule detects rundll32.exe invoking a DLL staged in the user LocalAppData directory with a single character export ordinal, the loader behavior of the KimJongRAT sys.dll module that Kimsuky drops into the user profile. Adversaries leverage rundll32 as a signed proxy to execute their DLL under a trusted process, making early detection critical for surfacing loader activity before browser and credential theft.

Malicious Word Spawning Rundll32 Loading DLL from Roaming Word Folder

This rule detects winword.exe launching rundll32.exe to load a DLL staged under the AppData Roaming Microsoft Word directory which is the Hancitor maldoc execution chain preceding Cuba ransomware. The malicious macro drops and side loads the loader from a user writable path. It is important because this parent child pattern reliably marks initial Hancitor infection.

Suspicious Rundll32 Loading DLL from User-Writable Path (via process_creation)

This rule detects rundll32.exe loading a DLL from a user-writable directory such as ProgramData or AppData. AresLoader downloads its DLL into %AllUsersProfile% and invokes it through rundll32 with an exported ordinal to run the loader. Rundll32 executing a DLL from a staging directory is a frequent proxy-execution and defense-evasion pattern.

Suspicious Rundll32 Execution of WebDAV-Hosted DLL via Entry Export (via process_creation)

This rule detects rundll32.exe loading a DLL from a WebDAV UNC path and calling the exported function named Entry. Strela Stealer uses this technique to execute a fileless DLL payload delivered over WebDAV.

Malicious Tpwinprn DLL Loaded via Renamed rundll32 by Diplomatic Specter

This rule detects execution referencing the Tpwinprn.dll payload run through a renamed copy of rundll32 from SysWOW64, a loader behavior tied to the Operation Diplomatic Specter Chinese cyberespionage campaign. Renaming a signed system binary to proxy DLL execution helps the actor evade image-name detections. Detecting this reveals masqueraded loader activity delivering the espionage toolkit.

Suspicious Masqueraded Rundll32 with Mismatched Original Filename (via process_creation)

This rule detects a process whose embedded original filename is RUNDLL32.EXE but whose on-disk name is something else. Nokoyawa intrusions run IcedID by copying rundll32 to a decoy name such as Calc.exe to blend into normal activity. A binary lying about its identity through a renamed copy is a reliable masquerading indicator.

Malicious rundll32 Loading dat Payload via afunix Export

This rule detects rundll32.exe loading a file with a .dat extension and invoking the afunix export with a key argument. This loader pattern is used by the Lazarus group during Operation SyncHole watering-hole attacks to execute the ThreatNeedle and related malware via a trusted signed binary. The non-DLL extension plus specific export name distinguishes it from normal rundll32 usage.

Suspicious Deadglyph Rundll32 DLL Execution by Ordinal via process_creation

This rule detects rundll32.exe executing the pbrtl.dll loader by ordinal