Sigma detection rules, expert-reviewed

Windows: Kapeka backdoor DLL (.wll) loaded via rundll32.exe

Flags rundll32.exe loading a suspicious .wll backdoor from ProgramData or AppData\Local.

Suspicious Child Process of KeyScrambler.exe on Windows

Alerts on KeyScrambler.exe launching cmd.exe, PowerShell, script hosts, regsvr32, or rundll32 as child processes.

Windows Process Creation: rundll32 Shell32 Control_RunDLL Executes .CPL from User Temp

Detects rundll32 Shell32 Control_RunDLL launching a .CPL from user Temp, a stealthy execution path.

Windows Utility Loads Unsigned DLL (ImageLoad)

Flags DLL loads by InstallUtil/RegAsm/RegSvcs/regsvr32/rundll32 when the loaded DLL is unsigned or untrusted.

Windows: Suspicious rundll32 Execution of Non-DLL Extension via Living-off-the-Land Parent Processes

Flags rundll32.exe executions from common script parents where the command line references known drop locations but lacks standard extensions.

Windows Process Execution: Suspicious cmd.exe Command-Line Combinations (Pikabot-like)

Alerts on cmd.exe /c command chains containing download/delay and rundll32 indicators consistent with Pikabot-like staging.

Windows Process Creation: rundll32 Spawns Pikabot-Like Hollowing Binaries

Alerts when rundll32.exe spawns specific Windows binaries in patterns consistent with potential process hollowing.

Windows Process Creation Signals for Pikabot System Discovery

Flags process-launch discovery commands (ipconfig/netstat/whoami) under rundll32 and Search host parent processes on Windows.

Windows rundll32.exe calling DllRegisterServer from a non-standard DLL path

Detects rundll32.exe calling DllRegisterServer from command lines associated with non-standard DLL locations.

Suspicious Child Process Spawned by Diskshadow.exe (Windows Process Creation)

Alerts on process creation where Diskshadow.exe spawns certutil, cscript, mshta, PowerShell, regsvr32, rundll32, or wscript.

Suspicious rundll32 Single-Digit DLL Execution with DllRegisterServer on Windows

Flags rundll32.exe running 1.dll with DllRegisterServer, a pattern seen in suspicious DLL execution.

Windows Browser-Injected rundll32 Execution Indicative of GuLoader Activity

Flags rundll32.exe being launched from a browser process, matching GuLoader-style injected browser execution behavior on Windows.

Windows rundll32.exe Using ShellExecute via ShellDispatch.dll Functionality

Alerts on rundll32.exe command lines referencing RunDll_ShellExecuteW, suggesting ShellDispatch.dll ShellExecute-based execution.

Windows: Detect Loading amsi.dll by LOLBIN Processes

Alert on amsi.dll DLL loads initiated by ExtExport.exe, Odbcconf.exe, or Rundll32.exe on Windows.

Windows Rundll32 Execution via Suspicious DLL Path Without .dll Extension

Alerts when rundll32.exe is started from suspicious parent scripts with a DLL-like path missing the .dll extension.