Sigma detection rules, expert-reviewed

Malicious WARMCOOKIE DLL Execution from RtlUpd Path via rundll32

This rule detects rundll32.exe executing a DLL from the C:\ProgramData\RtlUpd directory, the fixed drop path and loader behavior of the WARMCOOKIE backdoor. The malware writes RtlUpd.dll to this ProgramData location and runs it via rundll32 to establish its foothold.

Malicious LockBit Rundll32 Execution With gdll Export and -pass Argument

This rule detects rundll32.exe invoking a DLL export named gdll together with a -pass argument, the loader pattern used by LockBit 3.0 payloads staged from a batch file on the user Desktop. Huntress observed operators abusing a TeamViewer session to drop and run this payload for ransomware deployment. Catching the export and password-flag combination flags encryptor execution before file encryption completes.

Malicious EDR Termination via rundll32 Loading polers.dll Targeting Fortinet Processes (via process_creation)

This rule detects the Interlock EDR killer which uses rundll32.exe to invoke the exported start routine of polers.dll and terminate security processes matching the Forti pattern through a vulnerable anti cheat driver. The watchdog repeatedly relaunches to keep defenses down. This command line is unique to the tooling.

Suspicious Proxy Execution of rundll32 Control_RunDLL via pcalua.exe (via process_creation)

This rule detects the Program Compatibility Assistant launcher pcalua.exe being used to run rundll32 with shell32.dll Control_RunDLL, a living off the land chain that the RedCurl EarthKapre APT uses to proxy execution of its payload. The pcalua binary masks the parent-child lineage of the launched code. This nested launcher and control panel invocation is not a normal user or administrator workflow.

Suspicious Browser History Wipe via RunDll32 ClearMyTracksByProcess

This rule detects rundll32 invoking InetCpl ClearMyTracksByProcess to clear browsing and cache artifacts. The Gh0stGambit dropper used this to erase indicators after deploying Gh0st RAT. Programmatic history wiping through this control panel handler is a cleanup step rarely performed by normal user activity.

Malicious LATRODECTUS Loader DLL Execution via rundll32 via process_creation

This rule detects rundll32.exe executing a DLL from the LATRODECTUS Custom_update staging directory using its Update-prefixed filename. The loader drops its payload as an Update DLL and invokes it through rundll32 to initialize the ICEDID-successor implant. This execution pattern is characteristic of LATRODECTUS post-installation activity.

In-Memory Rundll32 Execution Without a Command Line (via process_creation)

This rule detects rundll32.exe running with no export or arguments on its command line, an anomalous state that legitimate use rarely produces and that commonly indicates code injection into a hollowed rundll32 process. Both System Binary Proxy Execution and Process Injection rank among the top techniques in the Red Canary Threat Detection Report, and an argument-less rundll32 is a strong heuristic for the latter. Detecting this pattern surfaces stealthy in-memory execution under a trusted binary.

Suspicious rundll32 Loading DEEPDATA data.dll with mod.dat Key via BrazenBamboo

This rule detects rundll32 loading data.dll together with a mod.dat argument the loading pattern of the BrazenBamboo DEEPDATA malware framework. DEEPDATA decrypts its payload using the mod.dat key file. Proxy execution via rundll32 helps evade application controls and disguise malware as a signed process.

Suspicious rundll32 Loading DLL from AppData via DllRegisterServer

This rule detects rundll32 executing a DLL located under AppData through the DllRegisterServer entry point. OysterLoader stages its COPYING3.dll payload in the roaming profile and runs it with this export. Running an AppData resident DLL through rundll32 with DllRegisterServer is a recognised loader execution pattern.

Malicious Rundll32 Execution Of HTML Payload With DllRegisterServer

This rule detects rundll32 loading a file with an .html extension and calling the DllRegisterServer export, the disguised DLL execution used in the Zloader attack against Intel 471. Masquerading the DLL as an HTML file evades extension-based inspection while rundll32 still runs it as a library. This mismatch of extension and export is a strong loader indicator.

Malicious SnipBot DLL Execution via rundll32 from KeyStore Directory (via process_creation)

This rule detects rundll32 loading SnippingTool.dll from a KeyStore folder and invoking its Main export, the execution technique used by the SnipBot variant of RomCom malware. Proxying execution of the malicious DLL through the trusted rundll32 binary helps the loader evade application controls.

Malicious Lazarus Rundll32 Execution of Sup ETL Privilege Escalation Loader (via process_creation)

This rule detects rundll32.exe executing a sup.etl file from the USOShared directory using the SerializeMarketTable export as observed in the Lazarus attack on Windows web servers. Loading an etl file as a DLL through an unusual export is a strong indicator of this loader.

Suspicious WARMCOOKIE Scheduled Task for rundll32 Persistence via process_creation

This rule detects creation of a scheduled task that runs rundll32 against the WARMCOOKIE loader RtlUpd at a short recurring interval to maintain persistence. The backdoor registers a task firing every ten minutes to ensure continuous execution. The combination of a minute-based recurrence with rundll32 loading this DLL is characteristic of WARMCOOKIE.

Suspicious DanaBot Updater Scheduled Task Running Rundll32 from AppData via schtasks

This rule detects creation of a scheduled task named Updater that launches rundll32.exe against a DLL staged under a per-user AppData Custom_update directory, a persistence pattern used by DanaBot when deploying IcedID. Attackers abuse task scheduler plus rundll32 proxy execution to survive reboots and blend malicious loader activity into routine update tasks.

Malicious NotPetya Payload Execution via Rundll32 Ordinal Export from Windows Directory

This rule detects rundll32 launching a DLL from the Windows root directory by ordinal export number one which matches the NotPetya execution pattern documented by NCC Group. The ransomware was copied into the Windows folder and executed via its first ordinal to encrypt disks and spread laterally.