Sigma detection rules, expert-reviewed

Malicious WebDAV Payload Execution via rundll32 davclnt.dll (via process_creation)

This rule detects rundll32.exe invoking DavSetCookie from davclnt.dll, a WebDAV execution technique used by the TimbreStealer campaign to run remote payloads. Executing through the WebDAV client library retrieves and launches code from a remote share under a signed binary.

Malicious rundll32 Executing w32analytics DLL Export (via process_creation)

This rule detects rundll32 loading w32analytics.dll and invoking its dll_u export, the execution stage of the loader observed in recent unusual malware. Proxying execution through rundll32 with a named DLL export runs attacker code under a trusted signed Windows utility.

WebDAV Remote Payload Retrieval via Rundll32 DavSetCookie

This rule detects rundll32.exe calling davclnt.dll with the DavSetCookie export followed by a remote host, a WebDAV based download and execution technique used by the Andromeda Gamarue cluster. This pattern pulls a remote payload over WebDAV while hiding behind a signed Windows binary.

Suspicious Scheduled Task Running rundll32 DllRegisterServer Every Minute

This rule detects creation of a scheduled task that repeatedly invokes rundll32 against the DllRegisterServer export on a per-minute trigger. OysterLoader uses this technique to persist a malicious DLL dropped into the user profile. A minute interval task launching rundll32 with DllRegisterServer is rarely legitimate and typically indicates loader persistence.

Windows Rundll32 Execution of Ammy Admin Agent DLL

Identifies rundll32 executions that invoke the Ammy Admin agent DLL with a run parameter on Windows.

Windows Security Event 4698: Kapeka-like Scheduled Task Creation

Flags suspicious Kapeka-like scheduled task creation via Event 4698 using TaskContent paths, rundll32/.wll command markers, and OneDrive/Sens Api task names.

Windows Registry Run Key Autorun Entries Targeting Kapeka Backdoor

Flags Windows Run key registry changes whose data matches a Kapeka-style rundll32 .wll (#1) autorun entry.

Kapeka backdoor execution via rundll32.exe with export ordinal #1 and -d on Windows

Flags rundll32.exe command lines launching a Kapeka payload from ProgramData/AppData Local using export ordinal #1 with "-d".

Windows Kapeka Backdoor Persistence via schtasks ONSTART or Run Registry Autorun

Flags Windows persistence creation for Kapeka using schtasks (ONSTART) or Run registry entries plus rundll32 ordinal-based execution.

Windows: Kapeka backdoor DLL (.wll) loaded via rundll32.exe

Flags rundll32.exe loading a suspicious .wll backdoor from ProgramData or AppData\Local.

Suspicious Child Process of KeyScrambler.exe on Windows

Alerts on KeyScrambler.exe launching cmd.exe, PowerShell, script hosts, regsvr32, or rundll32 as child processes.

Windows Process Creation: rundll32 Shell32 Control_RunDLL Executes .CPL from User Temp

Detects rundll32 Shell32 Control_RunDLL launching a .CPL from user Temp, a stealthy execution path.

Windows Utility Loads Unsigned DLL (ImageLoad)

Flags DLL loads by InstallUtil/RegAsm/RegSvcs/regsvr32/rundll32 when the loaded DLL is unsigned or untrusted.

Windows: Suspicious rundll32 Execution of Non-DLL Extension via Living-off-the-Land Parent Processes

Flags rundll32.exe executions from common script parents where the command line references known drop locations but lacks standard extensions.

Windows Process Execution: Suspicious cmd.exe Command-Line Combinations (Pikabot-like)

Alerts on cmd.exe /c command chains containing download/delay and rundll32 indicators consistent with Pikabot-like staging.