Sigma detection rules, expert-reviewed

Suspicious COLDRIVER BAITSWITCH Execution via Rundll32 Verifyme Export (via process_creation)

This rule detects rundll32 invoking a DLL export named verifyme as used by the COLDRIVER ClickFix chain to run the BAITSWITCH loader from a remote share. Rundll32 calling this export is characteristic of the campaign.

SwimSnake AutoRecoverDat.dll Execution via rundll32 or regsvr32 (via process_creation)

This rule detects rundll32.exe or regsvr32.exe executing AutoRecoverDat.dll, the module the SwimSnake (Silver Fox) group drops into the user AppData Embarcadero folder to load shellcode and deploy the WinOS backdoor. Adversaries proxy execution of the malicious DLL through trusted signed binaries to evade application controls, making early detection critical for catching the loader before backdoor communication.

Suspicious Rundll32 Loading DLL From User Desktop

This rule detects rundll32.exe loading a DLL located under a user Desktop directory, a staging pattern seen when LockBit 3.0 payloads were dropped alongside a launcher batch file during hands-on-keyboard intrusions. Legitimate software rarely places and runs DLLs directly from the Desktop. Flagging this location reveals attacker-controlled payloads executed via a trusted signed binary.

Malicious rundll32 Loading DLL from WebDAV SSL Share

This rule detects rundll32 loading a DLL from a WebDAV SSL share indicated by the @SSL path token, an intrusion step observed in ACR Stealer delivery chains. Executing a remotely hosted DLL over WebDAV lets the attacker run code without writing the payload to local disk and evades application controls.

Suspicious TimbreStealer Execution via rundll32 iernonce.dll (via process_creation)

This rule detects rundll32.exe loading iernonce.dll, the module executed via a run-once mechanism by the TimbreStealer information stealer targeting Mexican users. The stealer proxies its execution through rundll32 to evade defenses while collecting browser credentials.

Malicious Pikabot Rundll32 Loading DLL with Enter Export

This rule detects rundll32.exe loading a DLL and calling the Enter export, the loader execution used by Pikabot after a downloaded DAT payload is renamed to a DLL. Running the module through rundll32 proxy execution hides the malicious code under a trusted signed binary.

Suspicious DLL Sideloading via rundll32 Loading MSADOCG (via process_creation)

This rule detects rundll32.exe loading MSADOCG.DLL, the sideloaded module used to launch the SugarGh0st RAT payload. Sideloading a maliciously named DLL through rundll32 hides code execution behind a signed Windows utility.

Suspicious Rundll32 Execution Of DllGetClassObject Export via Process Creation

This rule detects rundll32.exe invoking the DllGetClassObjectGuid export. Cuba ransomware executes its loader DLL through rundll32 using this specific non-standard export name to proxy execution, an artifact with no known legitimate use.

Malicious rundll32 Execution of COLDCOPY DLL via COLDRIVER ClickFix

This rule detects rundll32.exe invoking COLDCOPY DLLs by their known filenames or by the humanCheck and verifyme export names used in COLDRIVER ClickFix lures. Attackers run these exports to launch the YESROBOT and MAYBEROBOT backdoors after tricking a user into pasting a Run dialog command.

Malicious LSASS Memory Dump via Rundll32 comsvcs.dll MiniDump

This rule detects rundll32.exe invoking the comsvcs.dll MiniDump export to dump process memory, a LOLBIN LSASS dumping technique documented by Huntress. Attackers first resolve the LSASS process id via tasklist and then dump its memory to harvest plaintext credentials and hashes. Because comsvcs MiniDump has no legitimate administrative use, this is a high-confidence credential-theft signal.

Suspicious Wscript Spawning Rundll32 to Load Remote DLL (via process_creation)

This rule detects wscript.exe launching rundll32.exe, an unusual parent-child relationship used by the Strela Stealer JavaScript loader to execute a WebDAV-hosted DLL payload. Legitimate scripts rarely invoke rundll32 in this manner.

Renamed Qbot Loader Execution via rundll32 Running DAT File with xlAutoOpen Export (via process_creation)

This rule detects rundll32.exe invoking a .dat file through the xlAutoOpen export, the execution behavior a Qbot XLL phishing chain uses to run its decrypted loader before injecting into wermgr.exe. Adversaries reuse the Excel add-in entry point from a renamed DLL to launch the banking trojan under a trusted binary, making early detection critical for stopping the intrusion at the loader stage.

Malicious Keylogger DLL Execution via Rundll32 klg.dll

This rule detects rundll32.exe loading a DLL named klg.dll which Interlock ransomware operators deploy as a keylogger to capture credentials and keystrokes. The specific module name executed through rundll32 is a reliable behavioral indicator of the keylogging component.

Suspicious rundll32 shell32.dll Ordinal 61 Execution

This rule detects rundll32.exe calling shell32.dll by ordinal number 61, a proxy-execution trick observed in the NightshadeC2 loader chain. Invoking shell32 functions by ordinal avoids readable export names and is used to launch further stages while blending into normal rundll32 usage. Ordinal-based shell32 execution rarely appears in legitimate activity.

Suspicious Browser History Clearing via RunDll32 InetCpl ClearMyTracksByProcess (via process_creation)

This rule detects rundll32.exe invoking InetCpl.cpl ClearMyTracksByProcess to wipe browsing history and cached traces, an indicator-removal behavior used by the CylindricalCanine GoldenEyeDog subgroup during the DigiCert-linked intrusion. Adversaries clear these tracks to hinder investigation after credential and screenshot collection, making detection useful for surfacing anti-forensic activity on a compromised host.