Sofacy Trojan Loader Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

This rule detects suspicious process creation activity involving 'rundll32.exe' executing a DLL from a user's local application data directory, specifically looking for command-line patterns that include '.dat"' or '.dll #1'. This behavior is characteristic of the Sofacy (APT28) Trojan loader. The rule filters out executions from the temporary directory to reduce false positives.