Fireball Archer Malware Installation via Rundll32

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

This rule detects the invocation of the 'Archer' malware using 'rundll32.exe'. Specifically, it looks for command-line arguments containing both 'rundll32.exe' and 'InstallArcherSvc'. This pattern indicates an attempt to execute a malicious DLL function named 'InstallArcherSvc' via the legitimate Windows utility 'rundll32.exe', which is a common technique for defense evasion and execution.