Sigma detection rules, expert-reviewed

PowerShell ScriptBlock Logging: Obfuscated RUNDLL Launcher using rundll32.exe and shell32.dll

Identifies PowerShell script content invoking rundll32.exe/shell32.dll via shellexec_rundll and referencing PowerShell.

PowerShell module activity launching rundll32 via shell32.dll obfuscation content

Alerts when PowerShell module payloads reference a shell32/rundll32 launcher pattern that includes PowerShell.

Windows System: Detect rundll32 Service Control Manager launches PowerShell via obfuscated parameters

Flags service creation where ImagePath uses rundll32/shell32 (shellexec_rundll) to invoke PowerShell.

Windows Security 4697: Obfuscated PowerShell via rundll32 shell32 shellexec_rundll

Alert on Security EID 4697 where service installation references rundll32/shell32.dll to launch PowerShell.

Windows Service Control Manager Rundll32 Obfuscation via Command-Line Encoded PowerShell

Detects service creation where ImagePath invokes rundll32 (shell32) with command-chain tokens indicative of obfuscated PowerShell.

Windows Security 4697: Obfuscated command uses rundll32 with shell32.dll

Alerts on EventID 4697 service command lines containing rundll32 with shell32.dll/shellexec_rundll and obfuscation-like script fragments.

Rundll32 Executes Setupapi.dll InstallHinfSection via Runonce.exe

Alerts when rundll32 passes setupapi.dll::InstallHinfSection arguments that result in launching runonce.exe.

Windows: Rundll32 LaunchApplication via pcwutl.dll

Flags rundll32.exe using pcwutl.dll to invoke LaunchApplication.

Windows TAIDOOR RAT DLL Load via rundll32 Command Line

Detects Windows process creation command lines consistent with TAIDOOR RAT DLL loading through rundll32.exe.

Windows process execution matching Winnti RedMimicry playbook (rundll32/cmd with temp batch and gthread/sigcmm DLLs)

Flags rundll32.exe/cmd.exe launches with Winnti-specific DLL and temp batch indicators.

Windows rundll32 WebDAV Client Execution (davclnt.dll DavSetCookie)

Flags svchost.exe spawning rundll32.exe to run davclnt.dll,DavSetCookie, consistent with WebDAV client execution.

Windows Process Memory Dump via comsvcs.dll using rundll32

Alert on rundll32 loading comsvcs.dll with arguments consistent with a full process memory dump.

Windows: Child Process Spawned with SYSTEM Integrity by LOCAL/NETWORK SERVICE Parent

Alert on Windows executions where a SYSTEM-integrity child is spawned by a LOCAL SERVICE or NETWORK SERVICE parent, excluding a specific rundll32 pattern.

Rundll32.exe DLL Export Calls by Ordinal (Windows Process Creation)

Detects rundll32.exe commands that specify DLL exports by ordinal using “.dll #” syntax.

PowerShell ScriptBlock uses rundll32 with shell32.dll and obfuscated invoke/comspec/iex

Flags PowerShell script blocks containing rundll32/shell32.dll execution strings alongside invoke/iex/comspec patterns.