Sigma detection rules, expert-reviewed

Malicious Lunar Spider Loader Execution via rundll32 (via process_creation)

This rule detects rundll32.exe loading the malicious upfilles.dll with the stow export. This behavior was observed in a Lunar Spider intrusion where a signed LOLBin was abused to run a malicious loader DLL. Detecting it exposes early execution and defense evasion before follow-on persistence and domain compromise.

Malicious LSASS Memory Dump via rundll32 comsvcs MiniDump in tasklist For-Loop (via process_creation)

This rule detects the comsvcs MiniDump LSASS technique where a cmd for-loop resolves the lsass process id from tasklist and hands it to rundll32 comsvcs to write a memory dump, the credential-access method used in the Akira intrusion. Adversaries use this signed-DLL export to dump LSASS without dropping a dedicated tool, so this chained tasklist and comsvcs pattern is a high-confidence credential-dumping indicator.

Malicious SYSTEM Persistence via Scheduled Task Running rundll32 at Startup (via process_creation)

This rule detects schtasks creating a SYSTEM-context ONSTART task whose action is rundll32 executing an exported function from a DLL in a public writable directory, the persistence mechanism used in the Cobalt Strike SOCKS LockBit intrusion. Adversaries chain a boot-triggered scheduled task with a rundll32 DLL export to reload their loader as SYSTEM after reboot, so this combination is a strong persistence and defense-evasion signal.

Malicious Rundll32 Executing Image File as DLL

This rule detects rundll32.exe being pointed at a file with an image extension such as jpg and invoking an export which the OneNote to ransomware actor used to run an IcedID payload disguised as a picture and this matters because a picture file being loaded as a DLL by rundll32 is a reliable masquerading indicator with no legitimate equivalent.

Suspicious Scheduled Task Executing Rundll32 DLL Export by Ordinal

This rule detects creation of a scheduled task that launches rundll32.exe against a DLL export referenced by ordinal number which the IcedID actor used to persist an hourly loader on the compromised host and this matters because scheduled execution of an ordinal DLL export by rundll32 is atypical for legitimate software and reflects malware persistence.

Malicious Renamed Rundll32 Copied to Temp via Xcopy

This rule detects xcopy copying the legitimate rundll32.exe binary into a user temp directory under a renamed filename as seen in the HTML smuggling IcedID intrusion that led to domain wide ransomware where the actor proxied execution of a malicious DLL through a renamed system binary and this matters because a renamed signed loader staged in temp is a strong indicator of defense evasion and hands on keyboard staging.

Suspicious rundll32 Executing DLL from ProgramData (via process_creation)

This rule detects rundll32.exe executing a DLL located in the ProgramData directory with an exported function name. The FROZEN#SHADOW campaign used this technique to launch its Cobalt Strike beacon staged as msedge.dll.

Suspicious Rundll32 Loading DLL From Public or ProgramData Path via Process Creation (via process_creation)

This rule detects rundll32.exe loading a DLL from a world-writable staging path such as Users Public, ProgramData, or the user temp directory, a LOLBin abuse pattern Red Canary describes for executing attacker-dropped code. System DLLs load from System32, so rundll32 sourcing a library from these locations strongly suggests execution of a malicious module.

Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)

This rule detects rundll32.exe invoking the comsvcs.dll MiniDump export to dump process memory, the LOLBin credential-theft technique Red Canary highlights for extracting secrets from LSASS. This is a well-known method to harvest credentials while blending in with a signed system binary, and its use is almost always malicious.

Suspicious Rundll32 Execution Without a DLL Reference via Process Creation (via process_creation)

This rule detects rundll32.exe executing without any .dll referenced on its command line, a pattern associated with Qbot (Qakbot) module loading as documented by Red Canary during the coordinated takedown. Legitimate rundll32 invocations almost always reference a DLL, so an execution lacking one is a strong indicator of injected or reflectively loaded malicious code worth investigating.

Suspicious WebDAV Retrieval via rundll32 and davclnt.dll (via process_creation)

This rule detects rundll32.exe loading davclnt.dll to retrieve content from a remote WebDAV share. This technique was observed in an exposed WebDAV malware delivery lab analyzed by Rapid7 where a search-ms URI pointed victims to a remote WebDAV host to stage follow-on payloads. WebDAV retrieval through the DAV mini-redirector is rarely used by legitimate software and often signals staged malware delivery.

Suspicious Rundll32 Execution with Latrodectus Loader Exports (via process_creation)

This rule detects rundll32.exe invoking non-standard DLL export names used by the Latrodectus loader. The malware and its downloader executed embedded DLLs via exports such as scab, nail, and fin.

Suspicious Rundll32 Execution with IcedID Loader Export (via process_creation)

This rule detects rundll32.exe invoking the PluginInit export or referencing license.dat, artifacts of the forked IcedID loader. The loader ran its DLL through the non-standard PluginInit export and stored its bot module as license.dat.

Malicious Scheduled Task Running rundll32 w32analytics (via process_creation)

This rule detects creation of a scheduled task named w32analytics that executes rundll32 against w32analytics.dll, a persistence mechanism observed in recent unusual malware analyzed by Unit 42. Combining scheduled task persistence with rundll32 proxy execution lets the loader run its DLL export on a recurring basis while evading direct binary controls.

Suspicious StrelaStealer DLL Execution via Rundll32 Hello Export from Temp (via process_creation)

This rule detects rundll32.exe invoking the hello export of a DLL located in an AppData or temp directory, the loader behavior StrelaStealer uses to run its stealer payload dropped by a JScript file. The combination of a proxy execution binary, a user writable path, and the campaign specific export name reflects the StrelaStealer execution stage rather than normal library invocation.